YH
Vendor
yhirose
26
CVEs
0
On KEV
2
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-103930 | CP cpp-httplib yhirose | 3.7 | Oct 14 | cpp-httplib open_stream serializes CRLF in request target into HTTP request line |
| CVE-2026-102944 | CP cpp-httplib yhirose | 7.5 | Oct 14 | cpp-httplib: Cookie header leaked on cross-origin redirect |
| CVE-2026-77358 | CP cpp-httplib yhirose | 8.2 | Aug 27 | cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close() |
| CVE-2026-77341 | CP cpp-httplib yhirose | 5.3 | Aug 27 | cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing |
| CVE-2026-54919 | CP cpp-httplib yhirose | 7.4 | Jul 10 | cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends |
| CVE-2026-45372 | CP cpp-httplib yhirose | 9.9 | May 29 | cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection |
| CVE-2026-46527 | CP cpp-httplib yhirose | 7.5 | May 29 | cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash |
| CVE-2026-45352 | CP cpp-httplib yhirose | 7.5 | May 29 | cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding |
| CVE-2026-34441 | CP cpp-httplib yhirose | 6.5 | Mar 31 | cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body |
| CVE-2026-33745 | CP cpp-httplib yhirose | 7.4 | Mar 27 | cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect |
| CVE-2026-32627 | CP cpp-httplib yhirose | 8.1 | Mar 13 | cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy |
| CVE-2026-31870 | CP cpp-httplib yhirose | 7.5 | Mar 11 | cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header |
| CVE-2026-29076 | CP cpp-httplib yhirose | 5.9 | Mar 7 | cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing |
| CVE-2026-28435 | CP cpp-httplib yhirose | 7.5 | Mar 4 | Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib |
| CVE-2026-28434 | CP cpp-httplib yhirose | 5.3 | Mar 4 | cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header |
| CVE-2026-22776 | CP cpp-httplib yhirose | 7.5 | Jan 12 | cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb |
| CVE-2026-21428 | CP cpp-httplib yhirose | 7.5 | Jan 1 | cpp-httplib has CRLF injection in http headers |
| CVE-2025-66577 | CP cpp-httplib yhirose | 5.3 | Dec 5 | cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust |
| CVE-2025-66570 | CP cpp-httplib yhirose | 9.8 | Dec 5 | cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*) |
| CVE-2025-53629 | CP cpp-httplib yhirose | 7.5 | Jul 10 | cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability |
| CVE-2025-53628 | CP cpp-httplib yhirose | 8.8 | Jul 10 | cpp-httplib does not limit the length of a line |
| CVE-2025-52887 | CP cpp-httplib yhirose | 7.5 | Jun 26 | cpp-httplib has unlimited number of http header fields, which causes memory leak |
| CVE-2025-46728 | CP cpp-httplib yhirose | 7.5 | May 6 | cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests |
| CVE-2025-0825 | CP Cpp-httplib Yhirose | 5.3 | Feb 4 | CRLF injection in Cpp-httplib |
| CVE-2023-26130 | CP Cpp-httplib Yhirose | 8.8 | May 30 | Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch,… |
| CVE-2020-11709 | CP Cpp-httplib Yhirose | 7.5 | Apr 12 | cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, which creates possibilities for CRLF injection and HTTP… |