CVE-2026-21428

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the write_headers function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21428.json",
    "cwe_ids": [
        "CWE-93"
    ]
}

References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type

GIT

Repo

https://github.com/yhirose/cpp-httplib

Events

Introduced

Fixed

781c55f120f945d254832660ef9487776b8a90fc

Fixed

98048a033a532ff22320ce1d11789f8d5710dfcd

Database specific

{
    "cpe": "cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.30.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.8

v0.10.9

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.18.5

v0.18.6

v0.18.7

v0.19.0

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.20.0

v0.20.1

v0.21.0

v0.22.0

v0.23.0

v0.23.1

v0.24.0

v0.25.0

v0.26.0

v0.27.0

v0.28.0

v0.29.0

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.13

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.10

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

vanir_signatures_modified

"2026-07-15T19:14:46Z"

vanir_signatures

[
    {
        "target": {
            "function": "ClientImpl::write_request",
            "file": "httplib.h"
        },
        "id": "CVE-2026-21428-2a3c35de",
        "digest": {
            "function_hash": "236783576194208022074912422607734971641",
            "length": 3337.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd"
    },
    {
        "target": {
            "function": "TEST",
            "file": "test/test.cc"
        },
        "id": "CVE-2026-21428-31c10d64",
        "digest": {
            "function_hash": "21230083771032333993136639908271811634",
            "length": 835.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd"
    },
    {
        "target": {
            "file": "test/test.cc"
        },
        "id": "CVE-2026-21428-448d1d4e",
        "digest": {
            "line_hashes": [
                "149066278595483493855647045669558341282",
                "218176843687203766514303688750036368582",
                "36395984737058306102492305876818156149",
                "93131711617347560139037053523218007776",
                "45174732858542764499925482307158537653",
                "279773556912318610451730088793098218503",
                "277234281654859354833338151130670461364",
                "314494236331862484654061324103828914858",
                "136760103424630328282988441890438143934",
                "15726091890124120109828290476748461765",
                "76556508603325617234579544446984262255",
                "99496090020014608424618678419031898992",
                "335975449700889255680156298553548466433",
                "133768166030581392097269098867277444429",
                "265020585373190799148156166855220153964",
                "27770235393975933996540380392045428241",
                "10226280177045922361835483296143219745",
                "33247392374783198708328400794859133751"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd"
    },
    {
        "target": {
            "file": "httplib.h"
        },
        "id": "CVE-2026-21428-746e0aeb",
        "digest": {
            "line_hashes": [
                "261101704612475793201431655521474618235",
                "144589759349256299201670368972538539041",
                "14267181052624035337458094170249302267",
                "284222080548487386926119947587123280263",
                "325375147206123982559252304512715923796",
                "197009881000278662781612493647102468119",
                "228545043346182666402236792122161832282",
                "175653250537658213357291402723937868653",
                "104227765803765844293956305785663278136",
                "168743860198275992295170544526578853962",
                "270089662993397192109201213448850263687",
                "7518849500697083840705577566274303515",
                "139416975375343922165160912439092283941",
                "283000712248793343507093691301483802539",
                "280958175002367772702631987063312568248",
                "11396608072443187724369991874410071781"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd"
    },
    {
        "target": {
            "function": "ClientImpl::open_stream",
            "file": "httplib.h"
        },
        "id": "CVE-2026-21428-8b207bc8",
        "digest": {
            "function_hash": "17615259011025421480534109435573669298",
            "length": 3361.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd"
    },
    {
        "target": {
            "function": "TEST",
            "file": "test/test.cc"
        },
        "id": "CVE-2026-21428-96e04230",
        "digest": {
            "function_hash": "261119415164471213635728064887671045638",
            "length": 937.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd"
    },
    {
        "target": {
            "function": "Server::write_response_core",
            "file": "httplib.h"
        },
        "id": "CVE-2026-21428-baa49ede",
        "digest": {
            "function_hash": "320522676550951009926090657476060146965",
            "length": 1961.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21428.json"