CVE-2026-103930: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in yhirose cpp-httplib

cpp-httplib is a C++ header-only HTTP/HTTPS library. Between versions 0.29.0 and 0.51.0, the Client::open_stream function accepts a caller-controlled path that bypasses the usual path encoding protections. This allows raw carriage-return and line-feed bytes to be injected into the HTTP/1.1 request line, causing HTTP request/response splitting. Exploitation requires the embedding application to pass remote user input into this vulnerable path and a backend or intermediary that interprets the injected bytes. The impact is limited to modification of backend-visible request data without direct confidentiality or availability effects. The vulnerability is fixed in version 0.51.0.

The vulnerability allows an attacker to inject CRLF sequences into HTTP request lines, potentially modifying backend-visible request data. There is no direct impact on confidentiality or availability. Exploitation requires specific conditions including remote user input reaching the vulnerable function and a backend or intermediary that processes the injected data.

Upgrade to cpp-httplib version 0.51.0 or later, where this vulnerability is fixed. No other mitigation is indicated.