CVE-2026-34441
HTTP Request Smuggling in cpp-httplib Server Static File Handler
Publication date: 2026-03-31
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yhirose | cpp-httplib | to 0.40.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-444 | The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in cpp-httplib, a C++11 single-file header-only cross platform HTTP/HTTPS library, in versions prior to 0.40.0. It is an HTTP Request Smuggling issue where the server's static file handler serves GET responses without consuming the request body. On HTTP/1.1 keep-alive connections, unread body bytes remain on the TCP stream and are interpreted as the start of a new HTTP request. This allows an attacker to embed an arbitrary HTTP request inside the body of a GET request, which the server then processes as a separate request.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to smuggle HTTP requests through the server by embedding arbitrary requests inside the body of a GET request. This can lead to unintended processing of malicious requests by the server, potentially causing information disclosure or manipulation of server behavior. The CVSS score indicates a low to medium impact with confidentiality and integrity impacts but no impact on availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade cpp-httplib to version 0.40.0 or later, where the HTTP Request Smuggling issue has been patched.