Insufficient verification of data authenticity in Cpp-httplib - CVE-2025-66570

Vulnerability identifier: #VU117687

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2025-66570

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to software trusts data passed via the X-Forwarded-For/X-Real-IP headers and uses this date when writing log entries or appending headers to the request. A remote attacker can modify these headers and poison log files or inject arbitrary HTTP headers into HTTP requests. 

Cpp-httplib
openEuler
Ubuntu
cpp-httplib (Ubuntu package)
cpp-httplib
cpp-httplib-devel
cpp-httplib-debugsource
cpp-httplib-debuginfo

Install updates from vendor's website.

Cpp-httplib - update to 0.27.0
cpp-httplib (Ubuntu package) - addressed in versions 0.10.3+ds-1ubuntu0.1~esm1, 0.14.3+ds-1.1ubuntu0.1~esm1, 0.18.7-1ubuntu0.25.04.1, 0.18.7-1ubuntu0.25.10.1
cpp-httplib - update to 0.27.0-1
cpp-httplib-devel - update to 0.27.0-1
cpp-httplib-debugsource - update to 0.27.0-1
cpp-httplib-debuginfo - update to 0.27.0-1

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xm2j-vfr9-mg9m

• Spoofing attack via X-Forwarded-For/X-Real-IP headers in Cpp-httplib
• openEuler 24.03 LTS SP2 update for cpp-httplib
• openEuler 24.03 LTS SP1 update for cpp-httplib
• openEuler 24.03 LTS update for cpp-httplib
• openEuler 22.03 LTS SP4 update for cpp-httplib
• openEuler 22.03 LTS SP3 update for cpp-httplib
• Ubuntu update for cpp-httplib