CVE-2025-0825 MEDIUM

CVE-2025-0825: CRLF injection in Cpp-httplib

Weakness CWE-113 · HTTP response splitting

Published February 4, 2025

Last update May 23, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

Key dates

02Disclosure timeline

February 4, 2025 CVE published

May 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-0825 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/113.html

Related vulnerabilities

04Related CVE

CVE-2020-3117 Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability CVE-2026-42578 Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation CVE-2020-5216 Limited header injection when using dynamic overrides with user input in RubyGems secure_headers CVE-2026-34520 AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass CVE-2025-55271 HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability