CRLF Injection Vulnerability in cpp-httplib: HTTP Response Splitting Risk
Summary
DEBIAN-CVE-2026-77341: cpp-httplib is a C++ header-only HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.41.0+ds-3~bpo13+1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cpp-httplib is a C++ header-only library designed for handling HTTP and HTTPS requests. It is widely used for its simplicity and ease of integration into C++ projects. The library allows developers to create web servers and clients with minimal overhead. However, a critical vulnerability has been identified in version 0.49.0, which exposes applications using this library to potential HTTP response splitting attacks.
Vulnerability Detail
In version 0.49.0 of cpp-httplib, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them. This oversight allows for CRLF (Carriage Return Line Feed) sequences to be injected into trailer fields, enabling attackers to forge additional headers or split the HTTP response. The lack of checks on field names and values means that any data influenced by an attacker can lead to serious security implications, including the potential for HTTP response splitting, where an attacker can manipulate the response sent to the client.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the chunked response trailer feature in cpp-httplib until you can update to the patched version. Ensure that any data being sent in trailer fields is sanitized to prevent CRLF injection.
Conclusion
The CRLF injection vulnerability in cpp-httplib poses a significant risk to applications using this library. By updating to version 0.50.0 or later, developers can protect their applications from potential HTTP response splitting attacks. It is crucial to remain vigilant and monitor for vulnerabilities using tools like Vulert.
See every vulnerability recorded for cpp-httplib →
FAQ
CRLF injection is a type of attack where an attacker can insert Carriage Return and Line Feed characters into HTTP headers, potentially allowing them to manipulate the response sent to clients.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any installation.
The consequences include the potential for HTTP response splitting, which can lead to header forgery, session hijacking, and other security risks.
Yes, you can temporarily avoid using the chunked response trailer feature and sanitize any data that may be influenced by user input.
You can find more information about cpp-httplib on its official GitHub repository or documentation page, which provides details on its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
