CVE-2026-21428

CVSS 7.5 · HIGH
1 public PoC
Proof-of-concept code linked in references
EPSS p3
Lower risk — in the top 97% least-likely-to-be-exploited CVEs.
Patch available
Vendor advisory or patch linked

Published 1/1/2026 · updated 1/6/2026 · CWE-93

Share
Get asset-aware triage

Summary

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.

CVSS 7.5HIGH

7.5 / 10
  • AV: Network
  • AC: Low complexity
  • PR: No privileges
  • UI: No user interaction
  • S: Scope unchanged
  • C: Confidentiality: None
  • I: Integrity: High
  • A: Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS exploitation probability

0.0%

Percentile p3 Lower risk — in the top 97% least-likely-to-be-exploited CVEs.

Affected products

1 vendor/product entries
  • Yhirose Cpp Httplib< 0.30.0
Do you run any of these? Sign in to match this CVE against your SBOM and asset inventory automatically.

Timeline

  1. Jan 1, 2026 · Disclosed / published in NVD
  2. Jan 6, 2026 · Intel last updated

Intel sources

Which upstream feeds returned data for this CVE, and when they were last fetched.

  • NVD· 59 days ago
  • CVE.org· 28 days ago
  • FIRST EPSS· 59 days ago
  • CISA KEV· no data
  • OSV· 28 days ago

References

Unlock the full report

See how CVE-2026-21428 hits your stack.

Free public data ends here. Sign in to correlate this CVE against your SBOM and assets, get an AI-grounded exploit chain, generate a ModSecurity virtual patch, and share findings with your team.

  • · Asset-aware CVSS & priority
  • · Grounded AI analysis (A–D graded)
  • · Auto-generated WAF / IPS rules
  • · Jira, SIEM, Slack, Teams delivery

No credit card · 100 free enrichments · analyst-grade citations.