CVE-2026-77341
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
cpp-httplib version 0.49.0 does not validate header names and values in chunked response trailers, allowing CRLF injection and HTTP response splitting. Applications placing attacker-influenced data into trailers can emit attacker-controlled CRLF. Fixed in version 0.50.0.
Risk Assessment
An attacker can forge response headers or inject a second response, potentially leading to cache poisoning, session hijacking, or other response splitting attacks.
Recommendation
Immediately upgrade cpp-httplib to version 0.50.0 or later.
Other vulnerabilities in cpp-httplib
See all- CVE-2026-22776High
cpp-httplib prior to version 0.30.1 contains a Denial of Service (DoS) vulnerability due to unsafe handling of compressed HTTP request bodies. The library validates payload_max_length against compressed data size but does not limit the size of decompressed data stored in memory.
- CVE-2026-21428High
cpp-httplib prior to version 0.30.0 does not check for CR & LF characters in user-supplied headers, allowing header injection and unexpected request body modification. This can lead to SSRF attacks, especially when combined with HTTP/1.1 pipelining servers. Version 0.30.0 fixes this issue.
- CVE-2026-45372Critical
The cpp-httplib library before version 0.44.0 improperly validates HTTP headers, allowing injection of newline characters via encoded header values.
- CVE-2025-66570Critical
cpp-httplib prior to 0.27.0 has a vulnerability that allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap, and the server later appends its own internal metadata without erasing duplicates, potentially leading to the use of attacker-controlled values.
- CVE-2026-77358High
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. This issue is fixed in version 0.50.1.
- CVE-2026-54919High
The cpp-httplib library versions 0.31.0 through 0.46.1 (Mbed TLS backend) and 0.33.0 through 0.46.1 (wolfSSL backend) skip certificate chain validation when connecting to an IP-literal host in HTTPS mode. This allows a man-in-the-middle attacker to present a crafted certificate and intercept or modify traffic.
- CVE-2026-46527High
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service).
- CVE-2026-45352Medium
cpp-httplib prior to 0.43.4 has a vulnerability related to negative chunk-size in chunked Transfer-Encoding. The ChunkedDecoder::read_payload function parses the chunk-size field using std::strtoul(), which accepts a leading minus sign, causing unsigned wrap-around. The library only rejects -1, but other negative values like -2 pass validation, leading to unbounded memory allocation and process crash.
- CVE-2026-34441Medium
cpp-httplib is vulnerable to HTTP Request Smuggling. The server does not consume the GET request body, and on keep-alive connections unread bytes are interpreted as a new request.
Original NVD description (English source)
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.