Hi,

The following vulnerability was published for cpp-httplib.

CVE-2026-103930[0]:
| cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0
| until 0.51.0, Client::open_stream in httplib.h accepts a caller-
| controlled path that reaches detail::write_request_line() without
| the detail::encode_path() protection used by the ordinary buffered
| request path. Raw carriage-return and line-feed bytes in the path
| can therefore split the outbound HTTP/1.1 request line and inject
| attacker-shaped request metadata. Exploitation requires an embedding
| application to pass remote user input into the open_stream path and
| a backend or intermediary that interprets the injected bytes; the
| established impact is modification of backend-visible request data,
| not direct confidentiality or availability impact. This issue is
| fixed in version 0.51.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-103930
https://www.cve.org/CVERecord?id=CVE-2026-103930
[1] https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-vq69-f637-8fhr
[2] https://github.com/yhirose/cpp-httplib/pull/2501
[3] https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore