CVE-2026-77341

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-113",
        "CWE-93"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77341.json"
}

References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type

GIT

Repo

https://github.com/yhirose/cpp-httplib

Events

Introduced

2132205e1a69c9fce8096f085b1b8d72efc759fa

Fixed

568d434e72fc51729d0ad33abffb181e5f7a453d

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.49.0"
        },
        {
            "fixed":  "0.50.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.49.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77341.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "126702690352149284549816669959803398003",
            "length":  2185
        },
        "id":  "CVE-2026-77341-1d05a94b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d",
        "target":  {
            "file":  "httplib.h",
            "function":  "write_content_chunked"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "119910460427898586202101125595396296568",
                "207913082477306364430239943781315849767",
                "166708078985808328290433878716538024043"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-77341-e13ce0d7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d",
        "target":  {
            "file":  "test/test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "313362602766064792238946008141526123255",
                "214829032227551615071554355353187655783",
                "247800420193573292021761261851731532700",
                "34503553311208297545730204576406061623"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-77341-fdb22bf8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d",
        "target":  {
            "file":  "httplib.h"
        }
    }
]

vanir_signatures_modified

"2026-09-11T08:26:27Z"