{
  "cveId": "CVE-2026-21428",
  "url": "https://patchblox.com/security/cve/CVE-2026-21428",
  "summary": "CVE-2026-21428 is fixed in cpp-httplib on 1 platform by DEBIAN-CVE-2026-21428 (version 0.41.0\u002Bds-3), released January 1, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "cpp-httplib: cpp-httplib is a C\u002B\u002B11 single-file header-only cross platform HTTP/HTTPS library",
  "description": "cpp-httplib is a C\u002B\u002B11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the \u0060\u0060write_headers\u0060\u0060 function does not check for CR \u0026 LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add extra headers, modify request body unexpectedly \u0026 trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.",
  "published": "2026-01-01T18:15:41Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "epss": 0.00404,
  "epssPercentile": 0.34898,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "cpp-httplib",
      "release": "Debian 14",
      "fixedVersion": "0.41.0\u002Bds-3",
      "fix": "DEBIAN-CVE-2026-21428",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-21428",
      "released": "2026-01-01T18:15:41Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}