Prior to version 0.44.0, the cpp‑httplib library performed percent‑decoding of all HTTP header values (excluding Location and Referer) after a basic validity check. This allowed encoded sequences such as %0D%0A to pass the check, resulting in literal carriage‑return and line‑feed bytes being injected into stored header values. The injected CRLF characters can then be used to split HTTP responses, enabling attackers to forge or manipulate response headers, potentially facilitating session fixation, redirects, or other unauthorized actions.

The vulnerability affects any deployment that uses the yhirose:cpp‑httplib library, any version before 0.44.0. The library is a C++11 header‑only HTTP/HTTPS client and server library used in many projects across platforms. Any application embedding that library as a server component is susceptible.

The CVSS score of 9.9 indicates a critical‑level exploit with high impact. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the attack can be performed remotely over the network by sending a specially crafted HTTP request to a server that uses the vulnerable library. Successful exploitation leads to HTTP header injection and potential response‑splitting attacks. The lack of an EPSS value does not diminish the inherent severity; organizations should treat this as a high‑risk issue until the library is updated.