HTTP response splitting in Cpp-httplib - CVE-2026-77341

Vulnerability details

The vulnerability allows a remote attacker to inject arbitrary HTTP response headers.

The vulnerability exists due to improper neutralization of crlf sequences in HTTP trailer headers in the done_with_trailer lambda within write_content_chunked() when writing chunked response trailers containing attacker-controlled input. A remote attacker can supply crafted input containing crlf characters that is reflected into trailer fields to inject arbitrary HTTP response headers.

Exploitation requires an application to reflect attacker-controlled data into chunked response trailers via DataSink::done_with_trailer().

Affected software

How to mitigate CVE-2026-77341

External References

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c

Related Security Bulletins

• HTTP response splitting in Cpp-httplib
• openEuler 24.03 LTS SP4 update for cpp-httplib
• openEuler 24.03 LTS SP3 update for cpp-httplib
• openEuler 24.03 LTS SP1 update for cpp-httplib