CrowCpp Crow through version 1.3.1 is vulnerable because it does not validate values written into HTTP response headers. An attacker can send specially crafted requests that cause the framework to insert unvalidated header values into the response. This allows manipulation of the HTTP response header fields, potentially changing how clients interpret the response.

All deployments of CrowCpp Crow that use version 1.3.1 or earlier are affected. No vendor‐specific information has been disclosed, so any application that incorporates this library may be vulnerable.

The CVSS score of 9.8 indicates a high severity. The EPSS score is < 1%, suggesting a very low probability that this vulnerability will be actively exploited. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is sending specially crafted HTTP requests with unvalidated header values to an application using CrowCpp Crow, requiring that the attacker can influence header content. The risk depends on the exposure of Crow-based applications and whether user input can affect header values.