{"id":"CVE-2026-77341","title":"cpp-httplib is a C++ header-only HTTP/HTTPS library","summary":"cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer …","severity":"none","cwe":["CWE-93","CWE-113"],"published":"2026-08-28","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77341","references":[{"url":"https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d","label":"security-advisories@github.com"},{"url":"https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c","label":"security-advisories@github.com"},{"url":"https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00272,"epssPercentile":0.19848,"ingestedAt":"2026-09-09T21:22:45.557Z","slug":"CVE-2026-77341","body":"## Overview\n\ncpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}