CVE-2020-11709 Other in n/a
Attackers can inject CRLF sequences via redirect or header parameters, enabling HTTP response splitting in applications using this C++ library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11709?
CVE-2020-11709 is a high-severity vulnerability in n/a, published on 12 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, which creates possibilities for CRLF injection and HTTP response splitting in some specific contexts.
Weakness: CWE-74
Which versions are affected by CVE-2020-11709?
It affects 1 product.
Products include Yhirose Cpp-Httplib.
How do I fix CVE-2020-11709?
No fix has been published for CVE-2020-11709 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-11709 being exploited?
There is no known exploitation of CVE-2020-11709 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-66570 cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)
- CVE-2026-45372 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection
- CVE-2026-46527 Null dereference in cpp-httplib
- CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy
- CVE-2026-22776 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb
Sources
Also known as GHSA-fxvr-q2f8-9vxv, UBUNTU-CVE-2020-11709.