PT-2020-12796 · Cpp Httplib · Cpp-Httplib

Shouco · Published 2020-04-12 · Updated 2025-08-05 · CVE-2020-11709

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions cpp-httplib versions 0.5.8 and earlier

Description The issue arises from the lack of filtering for r in parameters passed to the set redirect and set header functions, potentially leading to CRLF injection and HTTP response splitting in specific contexts.

Recommendations For cpp-httplib versions 0.5.8 and earlier, consider disabling the set redirect and set header functions until a patch is available to prevent potential CRLF injection and HTTP response splitting attacks. Restrict access to these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-11709

Affected Products

Cpp-Httplib

References · 13

• 🔥 https://github.com/yhirose/cpp-httplib/issues/425 · Exploit
• 🔥 https://gist.github.com/shouc/a9330df817128bc4c4132abf3de09495 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11709 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11709 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11709 · Security Note
• https://ubuntu.com/security/CVE-2020-11709 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11709 · Vendor Advisory
• https://github.com/yhirose/cpp-httplib/commit/85327e19ae7e72028c30917247238d638ce56d0b · Note
• https://t.me/cvenotify/99799 · Telegram Post
• https://t.me/cvenotify/2664 · Telegram Post
• https://t.me/cvenotify/52131 · Telegram Post
• https://t.me/cveNotify/130994 · Telegram Post
• https://t.me/cvenotify/78797 · Telegram Post