CVE-2025-66577

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.27.0

Description The software is a C++11 single-file header-only cross-platform HTTP/HTTPS library. A flaw exists where attacker-controlled HTTP headers can affect server-visible metadata, logging, and authorization decisions. Specifically, the get client ip() function in docker/main.cc unconditionally accepts X-Forwarded-For or X-Real-IP headers. This allows an attacker to spoof client IPs in access and error logs (log poisoning / audit evasion). The vulnerable function is get client ip().

Recommendations Update to version 0.27.0 or later.