CVE-2026-77341

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.50.0

Description The chunked-response trailer output path writes trailer header names and values directly to the socket without validation. This lack of checks for carriage return (CR) and line feed (LF) sequences allows an attacker to inject CRLF sequences into a trailer field. This leads to HTTP response splitting, which enables the forgery of response headers or the injection of a second response when an application includes attacker-influenced data in a chunked response trailer.

Recommendations Update to version 0.50.0.