CVE-2026-34441: Yhirose Cpp-httplib CSRF Vulnerability

CVE-2026-34441 Overview

CVE-2026-34441 is an HTTP Request Smuggling vulnerability affecting cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. Prior to version 0.40.0, the library's static file handler serves GET responses without properly consuming the request body. On HTTP/1.1 keep-alive connections, unread body bytes remain on the TCP stream and are interpreted as the start of a new HTTP request, allowing attackers to embed arbitrary HTTP requests inside the body of a GET request.

Critical Impact

Attackers can smuggle arbitrary HTTP requests through the server, potentially bypassing security controls, poisoning caches, or performing unauthorized actions on behalf of other users.

Affected Products

• yhirose cpp-httplib versions prior to 0.40.0

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-34441 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34441

Vulnerability Analysis

This HTTP Request Smuggling vulnerability (CWE-444) stems from improper handling of HTTP request bodies in the cpp-httplib static file handler. When the server processes GET requests for static files, it responds to the client without fully consuming any body content that may have been included with the request. In HTTP/1.1 connections using keep-alive, this creates a dangerous condition where leftover bytes from the unread request body remain in the TCP stream buffer.

The server then incorrectly interprets these residual bytes as the beginning of a new, separate HTTP request. This desynchronization between what the client intended and what the server processes enables request smuggling attacks where an attacker crafts a malicious request with a body containing a complete, arbitrary HTTP request that the server will execute as if it were legitimate.

Root Cause

The root cause lies in the static file handler's failure to drain the request body before sending its response. According to HTTP/1.1 specifications, servers must either consume the entire request body or close the connection. The vulnerable implementation violates this principle by leaving body data in the stream, creating ambiguity in request boundaries on persistent connections.

Attack Vector

The attack leverages network-accessible HTTP endpoints served by cpp-httplib. An attacker sends a specially crafted GET request to a static file endpoint with a body containing an embedded HTTP request. Since the static file handler ignores the body content, it sends its response while leaving the smuggled request data in the TCP buffer. The server then processes this leftover data as a new request, executing whatever operation the attacker embedded.

This attack requires no authentication or user interaction and can be executed remotely over the network. The impact includes potential cache poisoning, bypassing front-end security controls, hijacking user requests, and executing unauthorized server-side operations.

Detection Methods for CVE-2026-34441

Indicators of Compromise

• Unusual HTTP request patterns where GET requests to static files include large or unexpected request bodies
• Log entries showing multiple rapid sequential requests from the same connection with mismatched timing patterns
• Evidence of requests being processed that don't match client-side logs or expected traffic patterns

Detection Strategies

• Monitor HTTP traffic for GET requests to static file endpoints that include Content-Length headers or request bodies
• Implement deep packet inspection to identify potential request smuggling patterns, specifically requests containing embedded HTTP request syntax in body content
• Analyze web server logs for anomalous request sequences that could indicate desynchronization attacks

Monitoring Recommendations

• Enable verbose HTTP logging to capture full request headers and body sizes for static file requests
• Deploy web application firewalls (WAF) with HTTP desync detection capabilities
• Implement connection-level monitoring to track request/response pairs and identify boundary inconsistencies

How to Mitigate CVE-2026-34441

Immediate Actions Required

• Upgrade cpp-httplib to version 0.40.0 or later immediately
• If immediate upgrade is not possible, disable HTTP/1.1 keep-alive connections as a temporary measure
• Review application logs for any signs of previous exploitation attempts
• Assess any front-end proxies or load balancers for additional request smuggling protections

Patch Information

The vulnerability has been patched in cpp-httplib version 0.40.0. The fix ensures that request bodies are properly consumed before responses are sent on keep-alive connections, preventing leftover data from being misinterpreted as new requests. The patch is available through the GitHub Release v0.40.0. For complete details on the vulnerability and fix, refer to the GitHub Security Advisory GHSA-jv63-rm9j-6jwc.

Workarounds

• Disable HTTP/1.1 keep-alive connections by closing connections after each request until the patch can be applied
• Place a reverse proxy in front of cpp-httplib that normalizes requests and properly handles request bodies
• Configure front-end load balancers to reject GET requests that include unexpected request bodies to static file endpoints