CVE-2026-103930

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103930
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103930.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103930
Aliases
  • GHSA-vq69-f637-8fhr
Published
2026-10-14T18:19:38Z
Modified
2026-10-16T07:09:24Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
cpp-httplib open_stream serializes CRLF in request target into HTTP request line
Details

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-113"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103930.json"
}
References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type
GIT
Repo
https://github.com/yhirose/cpp-httplib
Events
Introduced
5304464a53f793f8e3e4777ea5941d60cf8c91e3
Fixed
255c075b82cf9f221e6e607e8e6789e6e2bf4c2a
Fixed
d66d9a95997d51a8ba9822a611d1267757741535
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.29.0"
        },
        {
            "fixed":  "0.51.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
latest
v0.*
v0.29.0
v0.30.0
v0.30.1
v0.30.2
v0.31.0
v0.32.0
v0.33.0
v0.33.1
v0.34.0
v0.35.0
v0.37.0
v0.37.1
v0.37.2
v0.38.0
v0.39.0
v0.40.0
v0.41.0
v0.42.0
v0.43.0
v0.43.1
v0.43.2
v0.43.3
v0.43.4
v0.44.0
v0.45.0
v0.45.1
v0.46.0
v0.46.1
v0.47.0
v0.48.0
v0.49.0
v0.50.0
v0.50.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103930.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "87146352156784854442887510214463356440",
            "length":  3631
        },
        "id":  "CVE-2026-103930-2f2ce095",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a",
        "target":  {
            "file":  "httplib.h",
            "function":  "ClientImpl::write_request"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "81423599876932545868698122450694445274",
            "length":  219
        },
        "id":  "CVE-2026-103930-6e4b93b2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a",
        "target":  {
            "file":  "httplib.h",
            "function":  "write_request_line"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "35226085029307464035666124870053022067",
                "24896640519577172481684639635306941226",
                "129439514731984492496708297476849572140",
                "207004389187233252420247608716317340546",
                "19286508548906627851277033358505185308",
                "266614952131347959349815165977417855528",
                "224557623128731744449577856793509926590",
                "85028512739951338091842831475646529592"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-103930-94a547cb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a",
        "target":  {
            "file":  "httplib.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "94076952045643421403996199485589572265",
                "253565580080181235031082814775663415825",
                "166708078985808328290433878716538024043"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-103930-e8fd1ea9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a",
        "target":  {
            "file":  "test/test.cc"
        }
    }
]
vanir_signatures_modified 
"2026-10-16T07:09:24Z"