CVE-2020-11709

7.5 highEPSS 1.7%

High (7.5) in yhirose cpp-httplib. EPSS 1.7% chance of exploitation in the next 30 days.

cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, which creates possibilities for CRLF injection and HTTP response splitting in some specific contexts.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2020-04-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

yhirose:cpp-httplib

References

https://gist.github.com/shouc/a9330df817128bc4c4132abf3de09495
https://github.com/yhirose/cpp-httplib/issues/425
https://gist.github.com/shouc/a9330df817128bc4c4132abf3de09495
https://github.com/yhirose/cpp-httplib/issues/425

Check your stack JSON