# CVE-2026-77341: cpp-httplib CRLF injection in chunked response trailers

Source: https://junglewise.ai/threats/cve-2026-77341-cpp-httplib-crlf-injection-in-chunked-response-trailers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77341 · Severity: info · CVSS 6.5 · Published 2026-08-28

cpp-httplib is a C++ HTTP/HTTPS library used in applications to handle web requests and responses. Version 0.49.0 contains a vulnerability where trailer headers in chunked HTTP responses are written to the network without validation, allowing an attacker to inject carriage return and line feed characters. This enables HTTP response splitting attacks, where an attacker can forge additional response headers or inject fake responses seen by clients, potentially leading to cache poisoning, cross-site scripting, or session fixation attacks.

Technologies: [Yhirose Cpp-Httplib](https://junglewise.ai/threats/technologies/cpp-httplib). Vendors: [Yhirose](https://junglewise.ai/threats/vendors/yhirose).

## Quick answers

**Is CVE-2026-77341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77341 being exploited in the wild.

**How severe is CVE-2026-77341?** Informational severity, with a CVSS score of 6.5, published 28 August 2026.

**Which products and versions are affected?** Yhirose Cpp-Httplib 0.49.0.

**Is there a fix for CVE-2026-77341?** A patch was published on 2026-08-21: Fixed in version 0.50.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-77341?** Check whether you run Yhirose Cpp-Httplib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CRLF injection (CWE-113/CWE-93) in the chunked response trailer output path within httplib.h. The done_with_trailer lambda (lines 7722-7728) writes trailer header names and values directly to the socket without calling is_field_name() or is_field_value() validation functions, unlike every other header-writing path in the library. An attacker can supply application input with embedded CR/LF bytes (0x0d, 0x0a) that pass through URL decoding and are reflected into a chunked response trailer via DataSink::done_with_trailer(), reaching the HTTP response stream unfiltered. This enables HTTP response splitting—forging additional headers or injecting second responses. The attack requires the application to place untrusted user input into trailer headers. The fix, released in version 0.50.0, applies the same field validation checks used elsewhere in the library before writing trailer fields to the wire.

## Affected products

- yhirose cpp-httplib 0.49.0

## Timeline

- 2026-08-28: disclosed: CVE-2026-77341 published
- 2026-08-21: patched: Fixed in version 0.50.0

## References

- [https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d](https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d)
- [https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c)

## Related threats

- [cpp-httplib cookie exposure in cross-origin redirect](https://junglewise.ai/threats/cve-2026-102944-cpp-httplib-is-a-c-header-only-http-https-library-prior-to-0-51)
- [cpp-httplib use-after-free in TLS WebSocket client](https://junglewise.ai/threats/cve-2026-77358-cpp-httplib-use-after-free-in-tls-websocket-client)
- [yhirose cpp-httplib denial of service via malformed X-Forwarded-For header](https://junglewise.ai/threats/cve-2026-46527-yhirose-cpp-httplib-denial-of-service-via-malformed-x-forwarded)
- [yhirose cpp-httplib CRLF injection in parse_header](https://junglewise.ai/threats/cve-2026-45372-yhirose-cpp-httplib-crlf-injection-in-parse-header)
- [yhirose cpp-httplib denial of service via negative chunk-size](https://junglewise.ai/threats/cve-2026-45352-yhirose-cpp-httplib-denial-of-service-via-negative-chunk-size)