CVE catalog
CVE-2025-66570
cpp-httplib vulnerability
- Severity
- Critical · CVSS 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.34% · Oct 25, 2026
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the client-supplied headers are parsed before server-inserted headers, downstream code that uses these header names may inadvertently use attacker-controlled values. Affected files/locations: cpp-httplib/httplib.h (read_headers, Server::process_request, Request::get_header_value, get_header_value_u64) and cpp-httplib/docker/main.cc (get_client_ip, nginx_access_logger, nginx_error_logger). Attack surface: attacker-controlled HTTP headers in incoming requests flow into the Request.headers multimap and into logging code that reads forwarded headers, enabling IP spoofing, log poisoning, and authorization bypass via header shadowing. This vulnerability is fixed in 0.27.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | cpp-httplib | sid | 0.41.0+ds-3 | fixed |
| Debian | cpp-httplib | forky | 0.41.0+ds-3 | fixed |
| Debian | cpp-httplib | trixie | 0.18.7-1+deb13u1 | vulnerable |
| Debian | cpp-httplib | trixie-security | 0.18.7-1+deb13u1 | vulnerable |
| Debian | cpp-httplib | bookworm | 0.11.4+ds-1+deb12u1 | vulnerable |
| Ubuntu | cpp-httplib | noble | Not reported | vulnerable |
| Ubuntu | cpp-httplib | noble | 0.14.3+ds-1.1ubuntu0.1~esm1 | fixed |
| Ubuntu | libcpp-httplib-dev | noble | 0.14.3+ds-1.1ubuntu0.1~esm1 | fixed |
| Ubuntu | libcpp-httplib0.14t64 | noble | 0.14.3+ds-1.1ubuntu0.1~esm1 | fixed |
| Ubuntu | cpp-httplib | pro | 0.13.1+ds-1ubuntu1 | vulnerable |
| Ubuntu | cpp-httplib | pro | 0.14.3+ds-1 | vulnerable |
| Ubuntu | cpp-httplib | pro | 0.14.3+ds-1.1 | vulnerable |
| Ubuntu | cpp-httplib | pro | 0.14.3+ds-1.1build1 | vulnerable |
| Ubuntu | cpp-httplib | pro | 0.14.3+ds-1.1build2 | vulnerable |
| Ubuntu | cpp-httplib | pro | 0.14.3+ds-1.1ubuntu0.1~esm1 | fixed |
| Ubuntu | cpp-httplib | 25.10 | 0.18.7-1 | vulnerable |
| Ubuntu | cpp-httplib | 25.10 | 0.18.7-1ubuntu0.25.10.1 | fixed |
| Opensuse | cpp-httplib | leap 16.0 | 0.22.0-160000.3.1 | fixed |
| Opensuse | cpp-httplib | tumbleweed | 0.28.0-1.1 | fixed |
| Suse | cpp-httplib | linux enterprise server 16.0 | 0.22.0-160000.3.1 | fixed |
| Suse | cpp-httplib | linux enterprise server for sap applications 16.0 | 0.22.0-160000.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | cpp-httplib | source | sid | 0.41.0+ds-3 | not yet assigned | Not reported | [1122027] |
| Debian | cpp-httplib | source | forky | 0.41.0+ds-3 | not yet assigned | Not reported | [1122027] |
| Debian | cpp-httplib | source | trixie | (unfixed) | not yet assigned | Not reported | [1122027] |
| Debian | cpp-httplib | source | bookworm | (unfixed) | not yet assigned | Not reported | [1122027] |
| Ubuntu | cpp-httplib | deb | noble | 0.14.3+ds-1.1ubuntu0.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | libcpp-httplib-dev | deb | noble | 0.14.3+ds-1.1ubuntu0.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | libcpp-httplib0.14t64 | deb | noble | 0.14.3+ds-1.1ubuntu0.1~esm1 | Not reported | Not reported | Not reported |
| Ubuntu | cpp-httplib | deb | pro | 0.14.3+ds-1.1ubuntu0.1~esm1 | Not reported | USN-7962-1 | Not reported |
| Ubuntu | cpp-httplib | deb | 25.10 | 0.18.7-1ubuntu0.25.10.1 | Not reported | USN-7962-1 | Not reported |
| Opensuse | cpp-httplib | rpm | leap 16.0 | 0.22.0-160000.3.1 | Not reported | OPENSUSE-SU-2026:20056-1 | Not reported |
| Opensuse | cpp-httplib | rpm | tumbleweed | 0.28.0-1.1 | Not reported | OPENSUSE-SU-2025:15844-1 | Not reported |
| Suse | cpp-httplib | rpm | linux enterprise server 16.0 | 0.22.0-160000.3.1 | Not reported | SUSE-SU-2026:20090-1 | Not reported |
| Suse | cpp-httplib | rpm | linux enterprise server for sap applications 16.0 | 0.22.0-160000.3.1 | Not reported | SUSE-SU-2026:20090-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libcpp-httplib0.11]Affected
Source package: [cpp-httplib]
Details (2)
0.11.4+ds-1+deb12u1· amd64 · bookwormAffected
usn · cpp-httplib · debian · bookworm; usn · cpp-httplib · debian · 12
0.11.4+ds-1+deb12u1· arm64 · bookwormAffected
usn · cpp-httplib · debian · bookworm; usn · cpp-httplib · debian · 12
- [libcpp-httplib-dev]Affected
Source package: [cpp-httplib]
Details (2)
0.11.4+ds-1+deb12u1· amd64 · bookwormAffected
usn · cpp-httplib · debian · bookworm; usn · cpp-httplib · debian · 12
0.11.4+ds-1+deb12u1· arm64 · bookwormAffected
usn · cpp-httplib · debian · bookworm; usn · cpp-httplib · debian · 12
[Debian 13 (Trixie)]
- [libcpp-httplib0.18]Affected
Source package: [cpp-httplib]
Details (4)
0.18.7-1+deb13u1· amd64 · trixieAffected
usn · cpp-httplib · debian · 13
0.18.7-1+deb13u1· arm64 · trixieAffected
usn · cpp-httplib · debian · 13
0.18.7-1+deb13u1· amd64 · trixie-securityAffected
usn · cpp-httplib · debian · 13
0.18.7-1+deb13u1· arm64 · trixie-securityAffected
usn · cpp-httplib · debian · 13
- [libcpp-httplib0.41]Affected
Source package: [cpp-httplib]
Details (2)
0.41.0+ds-3~bpo13+1· amd64 · trixie-backportsAffected
usn · cpp-httplib · debian · 13
0.41.0+ds-3~bpo13+1· arm64 · trixie-backportsAffected
usn · cpp-httplib · debian · 13
- [libcpp-httplib-dev]Affected
Source package: [cpp-httplib]
Details (6)
0.18.7-1+deb13u1· amd64 · trixieAffected
usn · cpp-httplib · debian · 13
0.18.7-1+deb13u1· arm64 · trixieAffected
usn · cpp-httplib · debian · 13
0.41.0+ds-3~bpo13+1· amd64 · trixie-backportsAffected
usn · cpp-httplib · debian · 13
0.41.0+ds-3~bpo13+1· arm64 · trixie-backportsAffected
usn · cpp-httplib · debian · 13
0.18.7-1+deb13u1· amd64 · trixie-securityAffected
usn · cpp-httplib · debian · 13
0.18.7-1+deb13u1· arm64 · trixie-securityAffected
usn · cpp-httplib · debian · 13
[openSUSE Tumbleweed]
- [cpp-httplib-devel]Unknown
Source package: [cpp-httplib]
Details (1)
0.49.0-1.2· x86_64 · tumbleweedUnknown · Fixed:
0.28.0-1.1Version impact unknown
usn · cpp-httplib · opensuse · tumbleweed
- [libcpp-httplib0_49]Unknown
Source package: [cpp-httplib]
Details (1)
0.49.0-1.2· x86_64 · tumbleweedUnknown · Fixed:
0.28.0-1.1Version impact unknown
usn · cpp-httplib · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15844-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-66570]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20090-1]
- [https://osv.dev/vulnerability/USN-7962-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15844-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20056-1]
- [https://security-tracker.debian.org/tracker/CVE-2025-66570]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66570.json]
- [https://ubuntu.com/security/notices/USN-7962-1]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]