CVE-2026-103930 cpp-httplib open_stream serializes CRLF in request target into HTTP request line
Attacker can inject CRLF bytes into HTTP request lines via open_stream, modifying backend-visible request data in cpp-httplib.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103930?
CVE-2026-103930 is a low-severity vulnerability in yhirose cpp-httplib, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.
Weakness: CWE-113
Which versions are affected by CVE-2026-103930?
How do I fix CVE-2026-103930?
No fix has been published for CVE-2026-103930 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-103930 being exploited?
There is no known exploitation of CVE-2026-103930 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-103930, GHSA-vq69-f637-8fhr, UBUNTU-CVE-2026-103930.