CVE-2020-11709

2020-04-1214:15:10

Google

osv.dev

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

44.7%

JSON

cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, which creates possibilities for CRLF injection and HTTP response splitting in some specific contexts.

CPENameOperatorVersion
cpp-httplibeq0.4.2
cpp-httplibeq0.5.1
cpp-httplibeq0.3.0
cpp-httplibeq0.3.1
cpp-httplibeq0.4.1
cpp-httplibeq0.5.8
cpp-httplibeq0.2.4
cpp-httplibeq0.5.6
cpp-httplibeq0.5.5
cpp-httplibeq0.2.2

Name	Operator	Version
cpp-httplib	eq	0.4.2
cpp-httplib	eq	0.5.1
cpp-httplib	eq	0.3.0
cpp-httplib	eq	0.3.1
cpp-httplib	eq	0.4.1
cpp-httplib	eq	0.5.8
cpp-httplib	eq	0.2.4
cpp-httplib	eq	0.5.6
cpp-httplib	eq	0.5.5
cpp-httplib	eq	0.2.2