CVE-2026-77341

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-113",
        "CWE-93"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77341.json"
}

References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type

GIT

Repo

https://github.com/yhirose/cpp-httplib

Events

Introduced

2132205e1a69c9fce8096f085b1b8d72efc759fa

Fixed

568d434e72fc51729d0ad33abffb181e5f7a453d

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.49.0"
        },
        {
            "fixed":  "0.50.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.49.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-77341.json"