{"id":"CVE-2025-66577","summary":"cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust","details":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by get_client_ip() in docker/main.cc, causing access and error logs (nginx_access_logger / nginx_error_logger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.","aliases":["GHSA-gfpf-r66f-5mh2"],"modified":"2026-08-12T09:48:08.617503Z","published":"2025-12-05T18:20:25.852Z","related":["SUSE-SU-2026:20090-1","openSUSE-SU-2025:15844-1","openSUSE-SU-2026:20056-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-117","CWE-807"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66577.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66577.json"},{"type":"ADVISORY","url":"https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-gfpf-r66f-5mh2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66577"},{"type":"FIX","url":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yhirose/cpp-httplib","events":[{"introduced":"0"},{"fixed":"eacc1ca98e5fef25184c7d417e8417225e05e65d"},{"fixed":"ac9ebb0ee333ce8bf13523f487bdfad9518a2aff"}],"database_specific":{"cpe":"cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.27.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v0.26.0","v0.25.0","v0.24.0","v0.23.1","v0.23.0","v0.22.0","v0.21.0","v0.20.1","v0.20.0","v0.19.0","v0.18.7","v0.18.6","v0.18.5","v0.18.4","v0.18.3","v0.18.2","v0.18.1","v0.18.0","v0.17.3","v0.17.2","v0.17.1","v0.17.0","v0.16.3","v0.16.2","v0.16.1","v0.16.0","v0.15.3","v0.15.2","v0.15.1","v0.15.0","v0.14.3","v0.14.2","v0.14.1","v0.14.0","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.6","v0.12.5","v0.12.4","v0.12.3","v0.12.2","v0.12.1","v0.12.0","v0.11.4","v0.11.3","v0.11.2","v0.11.1","v0.11.0","v0.10.9","v0.10.8","v0.10.7","v0.10.6","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.10","v0.9.9","v0.9.8","v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.9","v0.8.8","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.18","v0.7.17","v0.7.16","v0.7.15","v0.7.14","v0.7.13","v0.7.12","v0.7.11","v0.7.10","v0.7.9","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.13","v0.5.12","v0.5.11","v0.5.10","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.2","v0.4.1","v0.4.0","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.6","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66577.json","vanir_signatures_modified":"2026-08-12T09:48:08Z","vanir_signatures":[{"id":"CVE-2025-66577-032e3a59","signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"httplib.h","function":"has_header"},"deprecated":false,"digest":{"function_hash":"211639915249495605556406247598553603758","length":122}},{"signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"docker/main.cc","function":"print_usage"},"deprecated":false,"digest":{"function_hash":"59824275924222643092104203298436878897","length":1074},"id":"CVE-2025-66577-06e554aa","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["95818203396872946126233068898941044204","265737799393927286488464023681319695675","89338378455097449718371468556714976081","198672229088665218672633139369165265897","213064976865925059498785946467751728052","199200367556653636316853984367310871192","48105734522893591225302925408400195994","162869203827632632145200633919591381390","152958649109259218022348847969854178494","240663583434377107149437983569929234511","108950373651180947249017511803314412797","107447439366027365818687294781876050149","23380772304048930506531570016104270047","173740101324364649742620009613113936197","66305359015420715107979951117495037834","110332727694420415542977909257265321665","247633960332075200345674975570251802579","205131501545719659627231333940264783975","100203935227163279432658118518339893700","193042667813324484496891167759653579355","104263506093600687814284100591830963899","149669803656692398748414671664885491401","30324545344415687477847069960995266533","62287091175069280843480371355555573018","307097762933956638820428916000922736456","331918336141750915932541745428480971928","264228452946538583165182630860963617124","56892242813523519580566391594246523007","134449008376306921459541189796777211701","36903693351398944044358273552075261381","210778898305495867438473538050299284046","17267167288488765219126879385124530217","137963605042839593099960003988676239353","115289475012866943375913721802957453044","191750710673405380758628058664399903153","114835576574070679498974901677128973383","80063638506868269259042481713702461050","275795734847146760495011478890456174793","323667175909297168002958075016484226034","14567257543545610564300870654460074200","334243857410454076620264969125073431476","219285834642798779614670253369624439572","181735877950415318232742099571085239793","333920153210520673466618421203649406514","134255624353367393144714575781844568105","278227181354671945096302320642079475590","249611915759573277069937725690081922167","141427632348859355130735586382186615810","246134227403549136731912841407424615075","336609216959797787019308575804524861629","271991216790860930908791574840619835509","114693229550858896947033549060162996469","172578019086805111488262956960658079756","338386440966274437011308654001860914891"],"threshold":0.9},"id":"CVE-2025-66577-29e4f95e","signature_type":"Line","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"docker/main.cc"}},{"id":"CVE-2025-66577-380d5cad","signature_type":"Line","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"httplib.h"},"deprecated":false,"digest":{"line_hashes":["288587838992725280579261393712590293841","179178826506156294067797010915601097648","133535994317919995359163068165743696381","147533884307154444946982885411735619074","36751357194087975611817736135319139693","260464587476131073643420691536685362282","150347150819729255132692349192095276116","236009344024645341535330185777444059565","131965251375211639426662293924655665130","318833196408530880574440430724390889208","199002391503964900926712038371149312079","315009238228080611884493345374094474243","213871355765257400743049240907671641225","267252840775159401936414934592662196279","161115713507010317847876569679423325648","187315063727299660150762053880223702523","29318283208039288795517471742896182907","77782219032409859541310939429758656385","321205915960771525998903401075401600059","303159654451638057659174187423303434893","55389554466510745486724013179061692088","325729907128596286851314445705430066535","331231541094450455071562681430061276934","306262097089555815613745021290497029602","76428020437592757791624769712856721867","218076442185634809707669084021231908372","306024536282328365484749620089368482264","111087902338376062520768395918025903076","40748747969532151121922704483373258892","45097461641782754821353906427426763762","200181319017076626289389827144078493586","215785389979101820697285471653311630725","118958071645517167591099922125077227783"],"threshold":0.9}},{"source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"docker/main.cc","function":"get_client_ip"},"deprecated":false,"digest":{"function_hash":"321434341238069973289047902748031141194","length":362},"id":"CVE-2025-66577-3b6f0558","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"311717512562599687120374900807777089750","length":2083},"id":"CVE-2025-66577-3dac7e48","signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"docker/main.cc","function":"parse_command_line"}},{"deprecated":false,"digest":{"length":20365,"function_hash":"175433049236346953469518212335239330087"},"id":"CVE-2025-66577-6b229225","signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"test/test.cc","function":"SetUp"}},{"target":{"file":"docker/main.cc","function":"nginx_error_logger"},"deprecated":false,"digest":{"function_hash":"133932702808865348877319463287538252893","length":641},"id":"CVE-2025-66577-a9b3cead","signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff"},{"signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"function":"get_header_value","file":"httplib.h"},"deprecated":false,"digest":{"function_hash":"273180357415705739973839409723482329845","length":325},"id":"CVE-2025-66577-b3f714e2","signature_type":"Function"},{"digest":{"function_hash":"290811620172586141091079999531902874892","length":750},"id":"CVE-2025-66577-b6853e95","signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"docker/main.cc","function":"main"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["120017251896481401810482193239876394372","306534722914332144196388942944750675350","54398655719700835562928444182301289712","62356465471896721288602959892694741287","166397605190268315918788363763051545025","38883129169282458167530307697786422954","188485155259659080634487271189772840680","78392688952351040638286850897814972319","86467973368861533479545574442063816250","144625908640344205689495716551634146768","247329169896526663367508275821459373521","66483609367388334043172558880875978657","200586059129563609425471759759161256551","133776700565771595888070015379365742281","170097733691383819714708097850527814362","335663463978784722291243752233634841691","201337926666770128558898888307275588888","36805233405098437688011987256670055059","135283970743713236988075748477018334305"]},"id":"CVE-2025-66577-c7014340","signature_type":"Line","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"test/test.cc"}},{"digest":{"length":2242,"function_hash":"247222770561768009078115580334413315025"},"id":"CVE-2025-66577-cbbee0d3","signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"docker/main.cc","function":"setup_server"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff","target":{"file":"docker/main.cc","function":"nginx_access_logger"},"deprecated":false,"digest":{"function_hash":"41553223838529170232519042641007258033","length":618},"id":"CVE-2025-66577-fb42ce30"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}