Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77341— cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing

Quick assessment

Affected
yhirose cpp-httplib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

cpp-httplib 是一个纯头文件的 C++ HTTP/HTTPS 库。在 0.49.0 版本中，分块响应（chunked-response）的 trailer（尾随头）输出路径直接将 trailer 的字段名和字段值写入套接字，而未对其进行验证，使得 trailer 字段中的 CRLF 序列可用于注入额外头部或拆分 HTTP 响应。与库中其他所有头部写入路径不同，trailer 写入代码未应用任何针对字段名和字段值的检查（这些检查通常会拒绝回车符和换行符），因此，若应用程序将受攻击者控制的数据放入分块响应的

CVSS 5.3 · Medium EPSS 0.27% · P19

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
yhirose cpp-httplib >= 0.49.0, < 0.50.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77341

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
Source: CVE Program / CVE List V5
Vulnerability Description
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
yhirose cpp-httplib >= 0.49.0, < 0.50.0 -

II. Public POCs for CVE-2026-77341

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77341

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77341 (1)

Vendor Advisories for CVE-2026-77341 (1)

IV. Related Vulnerabilities

Same product: cpp-httplib
Same vendor: yhirose
Same weakness: CWE-93

V. Comments for CVE-2026-77341

No comments yet

Leave a comment