The flaw arises because the Client::open_stream function in cpp‑httplib accepts a caller‑controlled path without applying the usual URL encoding step. Raw carriage‑return and line‑feed bytes in the path are serialized unchanged into the HTTP/1.1 request line, which can split the line and inject attacker‑crafted request metadata. This can cause the downstream server or intermediary to receive a modified request that was not intended by the application. The vulnerability is categorized as a request smuggling / tampering weakness (CWE‑113) and does not provide direct confidentiality or availability impact.

Applications built with yhirose's cpp‑httplib 0.29.0 through 0.50.x that invoke Client::open_stream with user‑supplied paths are affected. The issue is resolved in version 0.51.0; consequently any use of an older version exposes the impacted code path.

The CVSS score of 3.7 indicates low severity, and EPSS data is currently unavailable, meaning no quantified exploitation probability is reported. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the embedding application to forward remote input into open_stream and a backend that interprets the injected CRLF bytes. Because the impact is limited to request data manipulation rather than direct compromise of the host, the overall risk is moderate, but the potential for altering request behavior warrants prompt mitigation.