Kouf320

**Name of the Vulnerable Software and Affected Versions** cpp-httplib versions prior to 0.50.0 **Description** The chunked-response trailer output path writes trailer header names and values directly to the socket without validation. This lack of checks for carriage return (CR) and line feed (LF) sequences allows an attacker to inject CRLF sequences into a trailer field. This leads to HTTP response splitting, which enables the forgery of response headers or the injection of a second response when an application includes attacker-influenced data in a chunked response trailer. **Recommendations** Update to version 0.50.0.

**Name of the Vulnerable Software and Affected Versions** cpp-httplib versions 0.33.0 through 0.50.0 **Description** The TLS-enabled WebSocket client contains a use-after-free flaw. In the `shutdown and close()` function, the SSL object is freed and its pointer is cleared; however, the subsequent WebSocket close process attempts to send a close frame through the SSL socket stream. Because the stream retains a raw copy of the now-dangling session pointer, it reads from and writes to the freed memory. This condition is also reachable via the client's destructor and its connect path, meaning a standard teardown of a secure WebSocket connection can trigger the issue. **Recommendations** Update to version 0.50.1.