CVE-2026-77341

Deferred Deferred - Pending Action

HTTP Response Splitting in cpp-httplib via Chunked Trailer

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-77341

Affected Vendors & Products

Vendor	Product	Version / Range
yhirose	cpp-httplib	to 0.50.0 (exc)
yhirose	cpp-httplib	0.50.0
cpp-httplib	cpp-httplib	to 0.50.0 (exc)
cpp-httplib	cpp-httplib	0.50.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CWE-113	The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

Executive Summary

This vulnerability is a CRLF (Carriage Return Line Feed) injection flaw in cpp-httplib version 0.49.0. It occurs in chunked response trailers where field names and values are written directly to the socket without validation. Attackers can inject CRLF sequences into trailer fields, enabling HTTP response splitting attacks that forge headers or inject additional responses.

Detection Guidance

To detect this vulnerability, check if your system uses cpp-httplib version 0.49.0. Run commands like 'grep -r "cpp-httplib" /path/to/project' or inspect dependency files for version 0.49.0. Monitor HTTP responses for unusual header splitting or CRLF sequences in trailers.

Impact Analysis

An attacker could exploit this to split HTTP responses, inject malicious headers, or poison caches. This may lead to cross-site scripting (XSS), session fixation, or misleading users with forged content. Applications using affected versions to serve user-controlled trailer data are at risk.

Compliance Impact

This vulnerability enables HTTP response splitting, which could allow attackers to inject malicious headers or content into responses. This could lead to data exfiltration, unauthorized access, or manipulation of user sessions, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade cpp-httplib to version 0.50.0 or later. Review and sanitize any user-controlled input used in HTTP response trailers. Apply input validation to prevent CRLF injection in trailer fields.

Hi! I’m here to help you understand CVE-2026-77341. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70