cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing

Description

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.

Scores

EPSS (exploitation in 30 days)

0.46% · top 60% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') (opens in a new tab)All about CWE-93 and its CVEs
• CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') (opens in a new tab)All about CWE-113 and its CVEs

Affected products

• yhirose · cpp-httplib

  • affected >= 0.49.0, < 0.50.0

References (2)

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c (opens in a new tab)x_refsource_CONFIRMexploit
• https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-77341](https://trackcve.app/badge/CVE-2026-77341.svg)](https://trackcve.app/cve/CVE-2026-77341)

Record last updated 28 Aug 2026, 15:30 UTC.