CrowCpp Crow through version 1.3.1 is vulnerable to response header injection because the framework does not validate values written into HTTP response headers. Based on the description, it is inferred that an attacker can inject arbitrary header values by sending specially crafted HTTP requests, which could enable the modification or hijacking of HTTP responses and potentially lead to information disclosure, impersonation, or injection of malicious content.

All deployments of CrowCpp Crow that use version 1.3.1 or earlier are affected. No vendor‑specific information has been disclosed, so any application that incorporates this library may be vulnerable.

The CVSS score is not published and the EPSS score is unavailable; the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is sending HTTP requests with unvalidated header values to an application that uses CrowCpp. The risk therefore depends on the exposure of Crow-based applications and the presence of user‑controlled header inputs.