CVE-2026-77341

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77341
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77341.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77341
Aliases
  • GHSA-2r2h-jc8w-w66c
Downstream
Published
2026-08-27T22:16:45Z
Modified
2026-09-11T08:26:27Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
Details

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-113",
        "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77341.json"
}
References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type
GIT
Repo
https://github.com/yhirose/cpp-httplib
Events
Introduced
2132205e1a69c9fce8096f085b1b8d72efc759fa
Fixed
568d434e72fc51729d0ad33abffb181e5f7a453d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.49.0"
        },
        {
            "fixed": "0.50.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.49.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77341.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "126702690352149284549816669959803398003",
            "length": 2185
        },
        "id": "CVE-2026-77341-1d05a94b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d",
        "target": {
            "file": "httplib.h",
            "function": "write_content_chunked"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "119910460427898586202101125595396296568",
                "207913082477306364430239943781315849767",
                "166708078985808328290433878716538024043"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-77341-e13ce0d7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d",
        "target": {
            "file": "test/test.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "313362602766064792238946008141526123255",
                "214829032227551615071554355353187655783",
                "247800420193573292021761261851731532700",
                "34503553311208297545730204576406061623"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-77341-fdb22bf8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d",
        "target": {
            "file": "httplib.h"
        }
    }
]
vanir_signatures_modified 
"2026-09-11T08:26:27Z"