The cpp-httplib library builds HTTP and HTTPS requests, and the bug originates from its write_headers function, which fails to sanitize carriage‑return and line‑feed characters in header values supplied by external actors. This flaw allows a malicious user to inject arbitrary header lines or fragment the request body, effectively manipulating the request payload. The weakness is classified as CWE‑93 and can enable server‑side request forgery, as well as unintended data leakage or service disruption when the library is used in environments that support HTTP/1.1 pipelining. Based on the CVE description, it is inferred that attackers can supply malicious header values over a network interface to exploit the library.

yhirose’s cpp‑httplib is affected when used in any application prior to version 0.30.0. The library is distributed as a single header file, so all projects that include it without updating to the patched release are susceptible. Versions before 0.30.0 lack header validation in write_headers, which is required to address the injection vulnerability.

The severity score of 7.7 indicates a high impact, and the EPSS score of less than 1 % suggests that, as of the last assessment, exploitation is not widespread. The flaw appears to be remote; although the CVE description does not explicitly state the attack vector, it is inferred that an attacker can supply malicious header values over a network interface that the target application processes. Because the library is widely used in small to medium‑sized services, the potential for harm exists, but the current low EPSS and lack of a KEV listing mean that immediate exploitation is unlikely. Nonetheless, the risk remains significant for deployments that have not yet applied the 0.30.0 fix or that operate in environments supporting HTTP/1.1 pipelining, which can magnify the impact.