cve/2023/CVE-2023-26130.md

### [CVE-2023-26130](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26130)
![](https://img.shields.io/static/v1?label=Product&message=yhirose%2Fcpp-httplib&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%200.12.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CRLF%20Injection&color=brighgreen)

### Description

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors.

**Note:** This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507).

### POC

#### Reference
- https://gist.github.com/dellalibera/094aece17a86069a7d27f93c8aba2280
- https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-5591194

#### Github
- https://github.com/dellalibera/dellalibera
- https://github.com/fkie-cad/nvd-json-data-feeds
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00			`### [CVE-2023-26130](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26130)`
			`![](https://img.shields.io/static/v1?label=Product&message=yhirose%2Fcpp-httplib&color=blue)`
			`![](https://img.shields.io/static/v1?label=Version&message=0%3C%200.12.4%20&color=brighgreen)`
			`![](https://img.shields.io/static/v1?label=Vulnerability&message=CRLF%20Injection&color=brighgreen)`

			`### Description`

Update CVE sources 2024-06-22 09:37 2024-06-22 09:37:59 +00:00			`Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. Note: This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507).`
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00
			`### POC`

			`#### Reference`
			`- https://gist.github.com/dellalibera/094aece17a86069a7d27f93c8aba2280`
			`- https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-5591194`

			`#### Github`
			`- https://github.com/dellalibera/dellalibera`
Update CVE sources 2024-05-28 08:49 2024-05-28 08:49:17 +00:00			`- https://github.com/fkie-cad/nvd-json-data-feeds`
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00