CVE-2026-22776

cpp-httplib prior to version 0.30.0 does not check for CR & LF characters in user-supplied headers, allowing header injection and unexpected request body modification. This can lead to SSRF attacks, especially when combined with HTTP/1.1 pipelining servers. Version 0.30.0 fixes this issue.

The cpp-httplib library before version 0.44.0 improperly validates HTTP headers, allowing injection of newline characters via encoded header values.

cpp-httplib prior to 0.27.0 has a vulnerability that allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap, and the server later appends its own internal metadata without erasing duplicates, potentially leading to the use of attacker-controlled values.

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. This issue is fixed in version 0.50.1.

cpp-httplib version 0.49.0 does not validate header names and values in chunked response trailers, allowing CRLF injection and HTTP response splitting. Applications placing attacker-influenced data into trailers can emit attacker-controlled CRLF. Fixed in version 0.50.0.

The cpp-httplib library versions 0.31.0 through 0.46.1 (Mbed TLS backend) and 0.33.0 through 0.46.1 (wolfSSL backend) skip certificate chain validation when connecting to an IP-literal host in HTTPS mode. This allows a man-in-the-middle attacker to present a crafted certificate and intercept or modify traffic.

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service).

cpp-httplib prior to 0.43.4 has a vulnerability related to negative chunk-size in chunked Transfer-Encoding. The ChunkedDecoder::read_payload function parses the chunk-size field using std::strtoul(), which accepts a leading minus sign, causing unsigned wrap-around. The library only rejects -1, but other negative values like -2 pass validation, leading to unbounded memory allocation and process crash.

cpp-httplib is vulnerable to HTTP Request Smuggling. The server does not consume the GET request body, and on keep-alive connections unread bytes are interpreted as a new request.