SB2026042437 - Inconsistent interpretation of HTTP requests in Cpp-httplib

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042437

SB2026042437 - Inconsistent interpretation of HTTP requests in Cpp-httplib

Published: April 24, 2026

Security Bulletin ID SB2026042437
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-34441)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to smuggle arbitrary HTTP requests.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the static file handler and request parsing logic when processing GET requests with a body on HTTP/1.1 keep-alive connections or requests containing both Content-Length and Transfer-Encoding headers. A remote attacker can send a specially crafted GET request with an embedded HTTP request to smuggle arbitrary HTTP requests.

When deployed behind a reverse proxy, the issue can enable proxy-backend desynchronization and proxy-level access control bypass.


Remediation

Install update from vendor's website.

References