CVE-2025-0825

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

La versión v0.17.3 a v0.18.3 de cpp-httplib no filtra los caracteres CRLF ("\r\n") cuando tienen como prefijo un byte nulo. Esto permite a los atacantes aprovechar la inyección CRLF que podría conducir a la división de la respuesta HTTP, XSS y más.