Junglewise Threat Intelligence

CVE-2026-34441: yhirose cpp-httplib HTTP request smuggling in static file handler

CVE-2026-34441 · Severity: medium · CVSS 4.8 · Published 2026-03-31

Technologies: Yhirose Cpp-Httplib. Vendors: Yhirose.

Executive brief

cpp-httplib is a popular C++ library used by developers to add web server and client capabilities to their applications. A security flaw in how the library handles web requests allows attackers to "smuggle" hidden commands inside otherwise normal-looking traffic. This could allow an attacker to bypass security filters, access restricted files, or interfere with other users' sessions on the same server.

Technical details

cpp-httplib is vulnerable to HTTP Request Smuggling (CWE-444). The root cause is twofold: first, the server's static file handler in `Server::routing()` returns a response for GET/HEAD requests without consuming the request body, leaving unread bytes on the TCP stream that the keep-alive loop interprets as a subsequent request. Second, the library fails to reject requests containing both 'Content-Length' and 'Transfer-Encoding' headers, violating RFC 9112 §6.3. An unauthenticated remote attacker can exploit these behaviors to embed arbitrary HTTP requests within the body of a GET request. This can lead to access control bypass, cache poisoning, or request hijacking. The issue is fixed in version 0.40.0.

Affected products

  • yhirose cpp-httplib < 0.40.0

Timeline

  • 2026-03-28: patched: Version 0.40.0 released
  • 2026-03-31: disclosed: GitHub Advisory GHSA-jv63-rm9j-6jwc published
  • 2026-03-31: advisory: CVE-2026-34441 published to NVD

References

Related threats