CVE-2026-77341: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in yhirose cpp-httplib

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path fails to validate carriage return and line feed (CRLF) sequences in trailer field names and values before writing them to the socket. Unlike other header-writing code paths, this lack of validation allows attacker-controlled CRLF sequences to be injected into the HTTP response, enabling HTTP response splitting. This vulnerability is tracked as CVE-2026-77341 and is fixed in version 0.50.0.

An attacker who can influence data placed into a chunked response trailer can inject CRLF sequences, causing HTTP response splitting. This can allow forging of response headers or injection of a second HTTP response, potentially leading to web cache poisoning, cross-site scripting, or other HTTP-level attacks. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on confidentiality and integrity.

Upgrade to cpp-httplib version 0.50.0 or later, where the vulnerability is fixed by proper validation of CRLF sequences in trailer headers. No other mitigation is required as the fix addresses the root cause.