CVE-2026-77341: cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing

Published Aug 27, 2026
·
Updated

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.

Affected Software

1 affected component
cpp-httplib>0.49.0<0.50.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade cpp-httplib to a version that resolves this vulnerability.

    Fixed in 0.50.0

Event History

Aug 27, 2026
CVE Published
via MITRE·10:16 PM
Data Sourced
via MITRE·10:16 PM
DescriptionWeakness

Frequently Asked Questions

1

Which applications are exposed to this issue?

Applications using cpp-httplib 0.49.0 are exposed if they write chunked HTTP responses and place attacker-influenced data into trailer header names or values. Other header-writing paths are described as applying CRLF validation; the affected path is specifically chunked-response trailer output.

2

What does an attacker need to exploit it?

An attacker needs influence over a trailer field name or value used by the application in a chunked response. They can supply carriage return and line feed sequences that are written directly to the socket.

3

What is the impact of successful exploitation?

The injected CRLF can split the HTTP response, allowing forged response headers or injection of a second response.

4

What should be done if upgrading is not immediately possible?

Do not place attacker-controlled data in chunked response trailer names or values. Validate trailer field names and values to reject carriage return and line feed characters before they are written.

5

Which version fixes the issue?

The issue is fixed in cpp-httplib version 0.50.0.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203