Crow (Crowcpp) - vulnerabilities (CVEs)

7 CVEs, 1 in the last 30 days, 14 known versions, newest CVE from 2026-10-24. Vendor: Crowcpp.

CVEs of Crow

• CVE-2026-116011 - CVSS 8.7 (high), 2026-10-24: Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by…
• CVE-2023-26142 - CVSS 6.5 (medium), 2023-09-12: All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not…
• CVE-2022-38667 - CVSS 9.8 (critical), 2022-08-22: HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports…
• CVE-2022-38668 - CVSS 7.5 (high), 2022-08-22: HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a…
• CVE-2022-34970 - CVSS 9.8 (critical), 2022-08-04: Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers…
• CVE-2021-23824 - CVSS 6.5 (medium), 2022-01-13: This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional…
• CVE-2021-23514 - CVSS 7.5 (high), 2022-01-13: This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server.