CVE-2026-21428: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21428 is a CRLF injection vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. The flaw exists in all versions prior to 0.30.0 and was disclosed on January 1, 2026. It allows unauthenticated attackers to inject carriage return and line feed characters into HTTP headers, enabling header injection, request body manipulation, and Server-Side Request Forgery (SSRF) when targeting HTTP/1.1 pipelining-capable servers. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences). The vulnerable write_headers function iterates over user-supplied headers and writes them directly to the stream without validating for \r or \n characters, allowing an attacker-controlled header value to break out of the current header line. This function is called from open_stream, which underpins all standard client methods (Get, Post, etc.), meaning any application passing untrusted data into request headers is affected. When the downstream server supports HTTP/1.1 pipelining (e.g., Spring Boot, Python Twisted), the injected content can be interpreted as a separate, attacker-crafted HTTP request, enabling SSRF. A public proof-of-concept is included in the GitHub Security Advisory (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to inject arbitrary HTTP headers, modify request bodies, and forge server-side requests to internal or external resources without authentication or user interaction. The primary impact is high integrity compromise — attackers can manipulate the HTTP request pipeline to cause the server to issue unintended requests, potentially reaching internal services not exposed to the public internet. Confidentiality and availability are not directly impacted by this vulnerability, but SSRF can serve as a pivot point for further internal network reconnaissance or exploitation (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating HTTP request splitting against a Python Twisted server. The EPSS score is approximately 0.045%, indicating low but non-zero probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is detectable by Nessus (plugin IDs 281600, 294951, 294942) and Qualys (IDs 287598, 287741) (GitHub Advisory, Feedly).

1. Identify a target application: Find an application using cpp-httplib versions ≤ 0.29.0 as an HTTP client that passes user-controlled or partially-controlled data into request headers.
2. Confirm pipelining support: Verify that the backend server the cpp-httplib client communicates with supports HTTP/1.1 pipelining (e.g., Spring Boot, Python Twisted).
3. Craft a malicious header value: Construct a header value containing embedded CRLF sequences to inject a second HTTP request. For example:

httplib::Headers request_headers = {
    {"Connection", "keep-alive"},
    {"A", "B\r\n\r\nPOST /xyz HTTP/1.1\r\nHost: 127.0.0.1:8080\r\n\r\nGET /x HTTP/1.1\r\n"}
};
cli.Get("/hi", request_headers);

4. Trigger the injection: Submit the crafted request through the vulnerable cpp-httplib client. The write_headers function writes the malicious value directly to the stream without sanitization.
5. Achieve SSRF: The pipelining-capable backend server interprets the injected content as a separate HTTP request, causing it to issue an unintended request to an attacker-specified internal or external resource (GitHub Advisory).

• Network: Outbound HTTP requests from the server to unexpected internal IP addresses or services not normally contacted; HTTP requests containing raw \r\n sequences within header values visible in proxy or WAF logs.
• Logs: Backend server access logs showing unexpected HTTP requests (e.g., POST /xyz or GET /x) that do not correspond to legitimate application traffic; requests arriving in rapid succession from the same connection suggesting pipelined injection.
• Application: Error responses with Error::InvalidHeaders from patched cpp-httplib clients (indicating attempted injection was blocked); anomalous HTTP 400 or connection reset responses from backend servers when processing malformed pipelined requests.

The vulnerability is fixed in cpp-httplib version 0.30.0, which introduces a check_and_write_headers function that validates header names and values using detail::fields::is_field_name and detail::fields::is_field_value before writing, returning an Error::InvalidHeaders error if invalid characters are detected. All users of cpp-httplib versions ≤ 0.29.0 should upgrade to v0.30.0 or later immediately (GitHub Release, Patch Commit). As a temporary workaround for organizations unable to patch immediately, restrict network access to applications using vulnerable versions and implement network-level controls (e.g., WAF rules) to detect and block HTTP requests containing CRLF sequences in header values (Red Hat).

Red Hat tracked the vulnerability via Bugzilla (Bug 2426666) and assigned it high severity, with dependent tracking bugs filed for multiple affected packages. Fedora issued updates for cpp-httplib in Fedora 42 and 43, and openSUSE/SUSE also released security updates addressing this CVE. The vulnerability received coverage from Linux security news outlets including linuxsecurity.com and pro-linux.de, and was registered in the ENISA European Vulnerability Database as EUVD-2026-0026 (Red Hat Bugzilla, Red Hat).