CVE-2026-21428 cpp-httplib has CRLF injection in http headers

What is CVE-2026-21428?

CVE-2026-21428 is a high-severity vulnerability in yhirose cpp-httplib, published on 1 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.

Weakness: CWE-93

Which versions are affected by CVE-2026-21428?

It affects 1 product.

Products include Yhirose Cpp-Httplib.

How do I fix CVE-2026-21428?

Upgrade to a fixed version.

Is CVE-2026-21428 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21428 exists.

Other vulnerabilities in yhirose cpp-httplib

• CVE-2025-66570 cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*) Critical 10.0
• CVE-2026-45372 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection Critical 9.9
• CVE-2026-46527 Null dereference in cpp-httplib High 8.7
• CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy High 8.7
• CVE-2026-22776 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-21428, GHSA-wpc6-j37r-jcx7, UBUNTU-CVE-2026-21428.