Inconsistent interpretation of HTTP requests in Cpp-httplib - CVE-2026-34441

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127466

Inconsistent interpretation of HTTP requests in Cpp-httplib - CVE-2026-34441

Published: April 24, 2026


Vulnerability identifier: #VU127466
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34441
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to smuggle arbitrary HTTP requests.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the static file handler and request parsing logic when processing GET requests with a body on HTTP/1.1 keep-alive connections or requests containing both Content-Length and Transfer-Encoding headers. A remote attacker can send a specially crafted GET request with an embedded HTTP request to smuggle arbitrary HTTP requests.

When deployed behind a reverse proxy, the issue can enable proxy-backend desynchronization and proxy-level access control bypass.


Affected software

Cpp-httplib
Fedora
openEuler
cpp-httplib-debuginfo
cpp-httplib-devel
cpp-httplib-debugsource
cpp-httplib

How to mitigate CVE-2026-34441

Install security update from vendor's website.

Cpp-httplib - update to 0.40.0
cpp-httplib-debuginfo - update to 0.40.0-1
cpp-httplib-devel - update to 0.40.0-1
cpp-httplib-debugsource - update to 0.40.0-1
cpp-httplib - update to 0.40.0-1
cpp-httplib - addressed in versions 0.48.0-1.el9, 0.48.0-1.el10_3, 0.48.0-1.fc43

External References

Related Security Bulletins