yhirose cpp-httplib up to 0.49.x Chunked Response Trailer response splitting

Summaryinfo

A vulnerability identified as critical has been detected in yhirose cpp-httplib up to 0.49.x. The impacted element is an unknown function of the component Chunked Response Trailer. Performing a manipulation results in response splitting. This vulnerability is reported as CVE-2026-77341. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in yhirose cpp-httplib up to 0.49.x. It has been classified as critical. This affects some unknown functionality of the component Chunked Response Trailer. The manipulation with an unknown input leads to a response splitting vulnerability. CWE is classifying the issue as CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-77341 since 08/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.50.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• yhirose

Name

• cpp-httplib

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49

Website

• Product: https://github.com/yhirose/cpp-httplib/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion