{"id":"CVE-2025-0825","summary":"CRLF injection in Cpp-httplib","details":"cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters (\"\\r\\n\") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.","modified":"2026-08-18T16:54:40.057346Z","published":"2025-02-04T14:11:51.741Z","database_specific":{"cna_assigner":"Checkmarx","cwe_ids":["CWE-113"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0825.json"},"references":[{"type":"ADVISORY","url":"https://advisory.checkmarx.net/advisory/CVE-2025-0825/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0825.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0825"},{"type":"FIX","url":"https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289"},{"type":"PACKAGE","url":"https://github.com/yhirose/cpp-httplib"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yhirose/cpp-httplib","events":[{"introduced":"61c418048d8b0e42cc55e908c1c2da1e2f617f86"},{"fixed":"54f8a4d0f34acb3cc508e337d9881296b70201ad"},{"fixed":"9c36aae4b73e2b6e493f4133e4173103c9266289"}],"database_specific":{"cpe":"cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.17.3"},{"fixed":"0.18.4"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v0.18.3","v0.18.2","v0.18.1","v0.18.0","v0.17.3"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-0825.json","vanir_signatures_modified":"2026-08-18T16:54:40Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289","target":{"file":"httplib.h","function":"Request::set_header"},"deprecated":false,"digest":{"length":198,"function_hash":"277590819831059525472533281089288552273"},"id":"CVE-2025-0825-2d71384a"},{"source":"https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289","target":{"file":"test/test.cc"},"deprecated":false,"digest":{"line_hashes":["260809132634571723839772955850142221824","319534684125098744198272177949270052092","96823469935756260405829661134819320602"],"threshold":0.9},"id":"CVE-2025-0825-9cbcc937","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-0825-b1762a9f","signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289","target":{"file":"httplib.h","function":"Response::set_header"},"deprecated":false,"digest":{"length":199,"function_hash":"282002448680622989766430596597376481670"}},{"deprecated":false,"digest":{"line_hashes":["122865845419926169633108976348119279437","98933187978073131876729465628352425928","135424939433162493096086386300940917929","238031900777529823881172876332142156481","13103752831172150952358981631739970420","294716977488620022515304112326686077489","276027594476214969815632879869087700889","235224613071864695515402239674036034424","65652300073549646086793421028308367337","294716977488620022515304112326686077489","276027594476214969815632879869087700889","279196033155740987593201962810448484335","315534572009822831089630188210732145852","310443426124241150645112224040646570913","294204733884467423012074930542100496786","298508178807259458117828438646272216561"],"threshold":0.9},"id":"CVE-2025-0825-c968b88a","signature_type":"Line","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289","target":{"file":"httplib.h"}},{"target":{"function":"Response::set_redirect","file":"httplib.h"},"deprecated":false,"digest":{"function_hash":"4183272750077159462135840059502598777","length":271},"id":"CVE-2025-0825-d0c62d47","signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}