CVE-2023-26130: 
Homebrew vulnerability analysis and mitigation

CVE-2023-26130 affects versions of the package yhirose/cpp-httplib before 0.12.4. The vulnerability was discovered by Alessio Della Libera and disclosed on May 22, 2023. The affected software is a C++ single-file header-only cross-platform HTTP/HTTPS library (Fedora Update).

The vulnerability is a CRLF (Carriage Return Line Feed) Injection that occurs when untrusted user input is used to set the content-type header in HTTP .Patch, .Post, .Put and .Delete requests. This issue was identified as CWE-93 and is related to an incomplete fix for a previous vulnerability (CVE-2020-11709). The CVSS v3.1 base score is 7.5 (High), with the vulnerability being remotely exploitable at the network level (Snyk Report).

When exploited, the vulnerability allows an attacker to add \r\n (carriage return line feeds) characters and inject additional headers in the request sent. This can lead to a total loss of integrity in the system, potentially allowing attackers to modify protected components. The vulnerability has a high integrity impact while maintaining no direct impact on confidentiality or availability (Snyk Report).

The recommended mitigation is to upgrade yhirose/cpp-httplib to version 0.12.4 or higher, which contains the fix for this vulnerability. The fix was implemented in a commit that addresses the CRLF injection problems (GitHub Release).