Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NSummary
CVE-2025-66570 is a critical-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Yhirose Cpp-Httplib. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Mark-of-the-Web Bypass (T1553.005); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201455
Vulnerability Data
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed…
more
into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the client-supplied headers are parsed before server-inserted headers, downstream code that uses these header names may inadvertently use attacker-controlled values. Affected files/locations: cpp-httplib/httplib.h (read_headers, Server::process_request, Request::get_header_value, get_header_value_u64) and cpp-httplib/docker/main.cc (get_client_ip, nginx_access_logger, nginx_error_logger). Attack surface: attacker-controlled HTTP headers in incoming requests flow into the Request.headers multimap and into logging code that reads forwarded headers, enabling IP spoofing, log poisoning, and authorization bypass via header shadowing. This vulnerability is fixed in 0.27.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 12 hardening rules · 6 OS baselines
V6.4.3V10.4.16V10.5.1V11.4.3
Mitigating Controls (NIST 800-53 r5) AI
Proper unique identification and authentication of users directly stops spoofing-based bypass of authentication.
Device identification and authentication before connection prevents spoofing of devices to bypass auth.
Authentication of non-organizational users blocks external spoofing attempts against the scheme.
Explicit requirement to protect session authenticity structurally prevents the weakness for communications.
Explicitly requires that every access decision be based on authoritative, protected decision data rather than caller-supplied inputs.
Authenticator management ensures credentials cannot be easily spoofed or reused to bypass authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.
Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.
CWE-345 directly impairs RC.RP-05's verification of restored-asset integrity/authenticity, largely defeating the outcome while still leaving other restoration-confirmation steps partially viable.
Proper management of identities/credentials reduces the chance that security decisions will be driven by untrusted inputs.
Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.
Policy-driven, least-privilege authorization reduces opportunities to bypass controls via tampered inputs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure authentication control directly mitigates authentication bypass by spoofing.
Authentication information management directly addresses credential handling that prevents spoofing.
Secure coding standards directly prohibit using untrusted inputs for security-critical decisions.
Security testing can detect spoofing vulnerabilities but does not prevent them by itself.
Access control policy reduces spoofing opportunities but does not prescribe authentication mechanisms.
Identity management supports unique identities but does not guarantee resistance to spoofing.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. prevents CWE-345
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-290
Oracle Linux 9 (1 rule)
- V-271525 OL 9 must have GPG signature verification enabled for all software repositories. prevents CWE-345
RHEL 7 (3 rules)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-290
- V-204447 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345
- V-204448 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345
RHEL 8 (3 rules)
- V-230264 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345
- V-230265 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345
- V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-290
RHEL 9 (1 rule)
- V-257822 RHEL 9 must have GPG signature verification enabled for all software repositories. prevents CWE-345