CVE-2026-77341: cpp-httplib HTTP Response Splitting XSS

CVE-2026-77341 Overview

CVE-2026-77341 is an HTTP response splitting vulnerability in cpp-httplib, a widely used C++ header-only HTTP/HTTPS library. Version 0.49.0 writes chunked-response trailer header names and values directly to the socket without validating them for carriage return (CR) and line feed (LF) characters. An attacker who can influence data placed into a chunked response trailer can inject CRLF sequences to forge additional response headers or split the HTTP response entirely. The flaw is tracked under CWE-93: Improper Neutralization of CRLF Sequences and is fixed in version 0.50.0.

Critical Impact
Attackers can inject arbitrary HTTP headers or a second HTTP response, enabling cache poisoning, cross-site scripting via forged headers, and session-related attacks against downstream clients and proxies.

Affected Products

cpp-httplib version 0.49.0
Applications embedding cpp-httplib that emit attacker-influenced data in chunked response trailers
Fixed in cpp-httplib version 0.50.0

Discovery Timeline

2026-08-28 - CVE-2026-77341 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-77341

Vulnerability Analysis

The vulnerability resides in the chunked-response trailer output path of cpp-httplib. Every other header-writing path in the library rejects CR and LF characters through fields::is_field_name() and fields::is_field_value() checks. The trailer-writing code omitted these checks entirely.

When an application places attacker-influenced data into a trailer field, the raw bytes are concatenated with ": " and "\r\n" and written directly to the socket. Embedded CRLF sequences terminate the trailer line prematurely and allow the attacker to append arbitrary headers or begin a second HTTP response on the wire.

Root Cause

The root cause is missing input validation on trailer field names and values. The library enforces consistent field validation across set_header() and standard header emission paths but skipped this enforcement for chunked-encoding trailers. This inconsistency is a classic CRLF injection [CWE-93] leading to HTTP Response Splitting.

Attack Vector

Exploitation requires the target application to (1) use chunked transfer encoding with trailers and (2) include untrusted data in a trailer field name or value. User interaction is required, typically in the form of a victim client requesting an attacker-influenced URL or resource. A successful attacker can forge Set-Cookie, cache control, or content headers, poison upstream proxy caches, or deliver a second forged response consumed by intermediaries.

     // Trailer
     if (trailer) {
       for (const auto &kv : *trailer) {
+        // Skip fields with invalid names or values to prevent response
+        // splitting via CR/LF injection, matching set_header().
+        if (!fields::is_field_name(kv.first) ||
+            !fields::is_field_value(kv.second)) {
+          continue;
+        }
         std::string field_line = kv.first + ": " + kv.second + "\r\n";
         if (!write_data(strm, field_line.data(), field_line.size())) {
           ok = false;

Source: cpp-httplib patch commit 568d434 — the fix adds the same name and value validation used by set_header() to the trailer emission loop, discarding any trailer entry containing invalid characters including CR and LF.

Detection Methods for CVE-2026-77341

Indicators of Compromise

Outbound HTTP responses containing unexpected \r\n sequences within trailer header values.
Duplicate or unexpected response headers such as Set-Cookie, Location, or Content-Type appearing after the trailer section.
Web server or reverse proxy logs showing malformed chunked responses or protocol errors on downstream hops.
Cache entries containing headers or bodies that do not match the origin application's expected output.

Detection Strategies

Perform a software composition analysis (SCA) scan of C and C++ projects to identify httplib.h at version 0.49.0.
Inspect application source for calls that populate trailer maps with request-derived or user-controlled data.
Deploy web application firewall (WAF) rules that flag response bodies containing embedded CRLF followed by header-like patterns.

Monitoring Recommendations

Alert on HTTP protocol anomalies emitted from services known to use chunked trailers.
Monitor upstream proxy and CDN logs for cache key desynchronization or response smuggling indicators.
Track dependency manifests and container images for pinned versions of cpp-httplib at or below 0.49.0.

How to Mitigate CVE-2026-77341

Immediate Actions Required

Upgrade cpp-httplib to version 0.50.0 or later and rebuild all dependent binaries.
Audit application code for any use of chunked response trailers populated with untrusted input.
Remove or sanitize CR and LF characters in any data flowing into trailer names or values before upgrading.

Patch Information

The fix is available in cpp-httplib 0.50.0 via commit 568d434e72fc51729d0ad33abffb181e5f7a453d. See the GitHub Security Advisory GHSA-2r2h-jc8w-w66c for full details. The patch aligns trailer validation with the existing set_header() enforcement using fields::is_field_name() and fields::is_field_value().

Workarounds

Disable use of chunked response trailers in applications that cannot immediately upgrade.
Validate and strip \r and \n from all trailer name and value inputs before passing them to the library.
Place a hardened reverse proxy in front of the application to normalize outbound responses and strip malformed headers.

bash

# Verify installed cpp-httplib version and upgrade
grep -R "CPPHTTPLIB_VERSION" /path/to/project/include/httplib.h

# Fetch the patched release
curl -L -o httplib.h \
  https://raw.githubusercontent.com/yhirose/cpp-httplib/v0.50.0/httplib.h