The cpp-httplib library had vulnerabilities identified as CVE-2025-66570 and CVE-2025-66577. CVE-2025-66570 involves IP spoofing, log poisoning, and authorization bypass via header shadowing due to acceptance and parsing of client-controlled injected HTTP headers in incoming requests. CVE-2025-66577 concerns access and error log poisoning with spoofed client IPs caused by unconditional acceptance of client-controlled 'X-Forwarded-For' and 'X-Real-IP' headers. These vulnerabilities allow attackers to manipulate HTTP headers to spoof IP addresses and poison logs, which can undermine security controls relying on these headers.

The vulnerabilities allow attackers to spoof client IP addresses and poison server logs, which can lead to authorization bypass and inaccurate logging. This undermines trust in client IP-based access controls and log integrity, potentially allowing unauthorized access or evasion of detection.

The update for cpp-httplib fixes these vulnerabilities. Since this is a software library, users should apply the security update provided by the vendor or project maintainers to remediate these issues. Patch status is not explicitly stated in the input data; therefore, check the vendor advisory for current remediation guidance.