CVE-2026-77341 cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
Attackers can inject CRLF sequences into HTTP trailer headers to split responses or forge headers in applications using cpp-httplib.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-77341?
CVE-2026-77341 is a medium-severity vulnerability in yhirose cpp-httplib, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.
Which versions are affected by CVE-2026-77341?
How do I fix CVE-2026-77341?
Upgrade to a fixed version.
Is CVE-2026-77341 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77341 exists.
Sources
Also known as DEBIAN-CVE-2026-77341, GHSA-2r2h-jc8w-w66c, OESA-2026-4092, OESA-2026-4093, OESA-2026-4094, UBUNTU-CVE-2026-77341.