Read the docs
TI-2026-53971 Aliases CVE-2026-77341

cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing

Priority MEDIUM 57CWE-113Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Fix Fixed cpp-httplib (yhirose): 0.50.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yhirosecpp-httplib0.49.0 to before 0.50.00.50.0Patch availableCNA
  • cpp-httplib Vendoryhirose Affected 0.49.0 to before 0.50.0 Fixed in 0.50.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*——yhirose
  • cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:* Versions — — ·yhirose

Remediation

  • Fix · CNA cpp-httplib (yhirose) Fixed in 0.50.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77341

References

Other 2

  • TI-2026-33163 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection CVSS 3.1CRITICAL 9.9
  • TI-2026-53978 cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close() CVSS 4.0HIGH 8.2
  • TI-2026-18294 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb CVSS 4.0HIGH 8.7
  • TI-2026-17313 cpp-httplib has CRLF injection in http headers CVSS 4.0HIGH 7.7
  • TI-2026-74409 cpp-httplib leaks Cookie headers on cross-origin redirect CVSS 3.1HIGH 7.5
  • TI-2026-33146 cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences