VulnerabilityAnalyzed

CVE-2025-0825

This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

MEDIUM 6.9EPSS 0.41%

Does this matter?

Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own.

Description

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.41% probability · 34th percentile
CISA KEV: Not listed
Weakness: CWE-113
Affected: yhirose/cpp-httplib
Source: 596c5446-0ce5-4ba2-aa66-48b3b757a647

References

https://advisory.checkmarx.net/advisory/CVE-2025-0825/Exploit, Third Party Advisory
https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.