Executive brief
cpp-httplib is a popular C++ library used by developers to add web server and client capabilities to their applications. A security flaw in how the library handles web requests allows attackers to "smuggle" hidden commands inside otherwise normal-looking traffic. This could allow an attacker to bypass security filters, access restricted files, or interfere with other users' sessions on the same server.
Technical details
cpp-httplib is vulnerable to HTTP Request Smuggling (CWE-444). The root cause is twofold: first, the server's static file handler in `Server::routing()` returns a response for GET/HEAD requests without consuming the request body, leaving unread bytes on the TCP stream that the keep-alive loop interprets as a subsequent request. Second, the library fails to reject requests containing both 'Content-Length' and 'Transfer-Encoding' headers, violating RFC 9112 §6.3. An unauthenticated remote attacker can exploit these behaviors to embed arbitrary HTTP requests within the body of a GET request. This can lead to access control bypass, cache poisoning, or request hijacking. The issue is fixed in version 0.40.0.
Affected products
- yhirose cpp-httplib < 0.40.0
Timeline
- 2026-03-28: patched: Version 0.40.0 released
- 2026-03-31: disclosed: GitHub Advisory GHSA-jv63-rm9j-6jwc published
- 2026-03-31: advisory: CVE-2026-34441 published to NVD