Executive brief
cpp-httplib is a C++ HTTP/HTTPS library used in applications to handle web requests and responses. Version 0.49.0 contains a vulnerability where trailer headers in chunked HTTP responses are written to the network without validation, allowing an attacker to inject carriage return and line feed characters. This enables HTTP response splitting attacks, where an attacker can forge additional response headers or inject fake responses seen by clients, potentially leading to cache poisoning, cross-site scripting, or session fixation attacks.
Technical details
The vulnerability is a CRLF injection (CWE-113/CWE-93) in the chunked response trailer output path within httplib.h. The done_with_trailer lambda (lines 7722-7728) writes trailer header names and values directly to the socket without calling is_field_name() or is_field_value() validation functions, unlike every other header-writing path in the library. An attacker can supply application input with embedded CR/LF bytes (0x0d, 0x0a) that pass through URL decoding and are reflected into a chunked response trailer via DataSink::done_with_trailer(), reaching the HTTP response stream unfiltered. This enables HTTP response splitting—forging additional headers or injecting second responses. The attack requires the application to place untrusted user input into trailer headers. The fix, released in version 0.50.0, applies the same field validation checks used elsewhere in the library before writing trailer fields to the wire.
Affected products
- yhirose cpp-httplib 0.49.0
Timeline
- 2026-08-28: disclosed: CVE-2026-77341 published
- 2026-08-21: patched: Fixed in version 0.50.0