CVE-2025-66577

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by get_client_ip() in docker/main.cc, causing access and error logs (nginx_access_logger / nginx_error_logger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.

Published Dec 9, 2025

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-gfpf-r66f-5mh2

CVSS ScoreMedium

5.3

Ecosystem	Package	Version

Ecosystem	Package	Version

Vulnerabilities

CVE-2025-66577

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by get_client_ip() in docker/main.cc, causing access and error logs (nginx_access_logger / nginx_error_logger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.

Published Dec 9, 2025

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-gfpf-r66f-5mh2

CVSS ScoreMedium

5.3


conan	cpp-httplib	0.10.1
conan	cpp-httplib	0.10.3
conan	cpp-httplib	0.10.4
conan	cpp-httplib	0.10.6
conan	cpp-httplib	0.10.7
conan	cpp-httplib	0.10.8
conan	cpp-httplib	0.10.9
conan	cpp-httplib	0.11.0
conan	cpp-httplib	0.11.1
conan	cpp-httplib	0.11.2
conan	cpp-httplib	0.11.3
conan	cpp-httplib	0.11.4
conan	cpp-httplib	0.12.0
conan	cpp-httplib	0.12.1
conan	cpp-httplib	0.12.2
conan	cpp-httplib	0.12.3
conan	cpp-httplib	0.12.4
conan	cpp-httplib	0.12.5
conan	cpp-httplib	0.12.6
conan	cpp-httplib	0.13.1
conan	cpp-httplib	0.13.3
conan	cpp-httplib	0.14.0
conan	cpp-httplib	0.14.1
conan	cpp-httplib	0.14.2
conan	cpp-httplib	0.14.3
conan	cpp-httplib	0.15.1
conan	cpp-httplib	0.15.2
conan	cpp-httplib	0.15.3
conan	cpp-httplib	0.16.0
conan	cpp-httplib	0.16.3
conan	cpp-httplib	0.17.1
conan	cpp-httplib	0.17.3
conan	cpp-httplib	0.18.0
conan	cpp-httplib	0.18.1
conan	cpp-httplib	0.18.2
conan	cpp-httplib	0.18.3
conan	cpp-httplib	0.19.0
conan	cpp-httplib	0.20.1
conan	cpp-httplib	0.5.13
conan	cpp-httplib	0.5.4
conan	cpp-httplib	0.5.7
conan	cpp-httplib	0.5.8
conan	cpp-httplib	0.6.6
conan	cpp-httplib	0.7.0
conan	cpp-httplib	0.7.10
conan	cpp-httplib	0.7.12
conan	cpp-httplib	0.7.15
conan	cpp-httplib	0.7.18
conan	cpp-httplib	0.7.5
conan	cpp-httplib	0.7.6

Ecosystem	Package	Version


conan	cpp-httplib	0.10.1
conan	cpp-httplib	0.10.3
conan	cpp-httplib	0.10.4
conan	cpp-httplib	0.10.6
conan	cpp-httplib	0.10.7
conan	cpp-httplib	0.10.8
conan	cpp-httplib	0.10.9
conan	cpp-httplib	0.11.0
conan	cpp-httplib	0.11.1
conan	cpp-httplib	0.11.2
conan	cpp-httplib	0.11.3
conan	cpp-httplib	0.11.4
conan	cpp-httplib	0.12.0
conan	cpp-httplib	0.12.1
conan	cpp-httplib	0.12.2
conan	cpp-httplib	0.12.3
conan	cpp-httplib	0.12.4
conan	cpp-httplib	0.12.5
conan	cpp-httplib	0.12.6
conan	cpp-httplib	0.13.1
conan	cpp-httplib	0.13.3
conan	cpp-httplib	0.14.0
conan	cpp-httplib	0.14.1
conan	cpp-httplib	0.14.2
conan	cpp-httplib	0.14.3
conan	cpp-httplib	0.15.1
conan	cpp-httplib	0.15.2
conan	cpp-httplib	0.15.3
conan	cpp-httplib	0.16.0
conan	cpp-httplib	0.16.3
conan	cpp-httplib	0.17.1
conan	cpp-httplib	0.17.3
conan	cpp-httplib	0.18.0
conan	cpp-httplib	0.18.1
conan	cpp-httplib	0.18.2
conan	cpp-httplib	0.18.3
conan	cpp-httplib	0.19.0
conan	cpp-httplib	0.20.1
conan	cpp-httplib	0.5.13
conan	cpp-httplib	0.5.4
conan	cpp-httplib	0.5.7
conan	cpp-httplib	0.5.8
conan	cpp-httplib	0.6.6
conan	cpp-httplib	0.7.0
conan	cpp-httplib	0.7.10
conan	cpp-httplib	0.7.12
conan	cpp-httplib	0.7.15
conan	cpp-httplib	0.7.18
conan	cpp-httplib	0.7.5
conan	cpp-httplib	0.7.6

Find vulnerabilities. Fix fast with AI.

CVE-2025-66577

CVE-2025-66577