CVE-2026-77341: cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cpp-httplibto a version that resolves this vulnerability.Fixed in 0.50.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using cpp-httplib 0.49.0 are exposed if they write chunked HTTP responses and place attacker-influenced data into trailer header names or values. Other header-writing paths are described as applying CRLF validation; the affected path is specifically chunked-response trailer output.
What does an attacker need to exploit it?
An attacker needs influence over a trailer field name or value used by the application in a chunked response. They can supply carriage return and line feed sequences that are written directly to the socket.
What is the impact of successful exploitation?
The injected CRLF can split the HTTP response, allowing forged response headers or injection of a second response.
What should be done if upgrading is not immediately possible?
Do not place attacker-controlled data in chunked response trailer names or values. Validate trailer field names and values to reject carriage return and line feed characters before they are written.
Which version fixes the issue?
The issue is fixed in cpp-httplib version 0.50.0.