cpp-httplib CVE-2026-77341

Exploitation requires two simultaneous application-level conditions: first, the application must invoke cpp-httplib's chunked content provider API with trailer support (set_chunked_content_provider combined with done_with_trailer()), which is a non-default and relatively uncommon code path distinct from standard response APIs; second, attacker-controlled data must reach a trailer field name or value without prior CRLF sanitization in application code. Neither condition is met by typical cpp-httplib usage. Factors limiting exploitation include the passive user-interaction requirement (UI:P in CVSS 4.0) meaning a victim's HTTP client must receive and process the crafted response, the specificity of the chunked-trailer code path which many deployments never invoke, and the absence of any known public exploit beyond the library's own regression test. The CVSS PR:N metric indicates no authentication is required on the attacker's side, but the attacker must control input that a server-side code path reflects into trailer fields.

The CVSS 4.0 base score of 5.3 (Medium), vector AV:N/AC:L/AT:N/PR:N/UI:P, indicates network-reachable exploitation with no authentication required and passive user interaction, reflecting a scenario where a victim's HTTP client receives and processes the split response. The subsequent-system impact metrics SC:L/SI:L confirm that the primary harm falls on the downstream client rather than the server itself. Real-world risk is substantially lower than the network-level metrics imply: exploitation requires a specific application pattern - chunked responses with trailers containing attacker-reflected data - that is neither a default cpp-httplib usage nor a common idiom. No EPSS data was provided in the intelligence feed, making probability-of-exploitation estimation unavailable from that signal. No CISA KEV listing and no standalone POC have been identified; the commit diff includes a test case demonstrating the injection but this is part of the fix, not a weaponized exploit. The CVSS vector's AC:L may overstate ease of exploitation since it does not capture the application-level prerequisite of actually reflecting untrusted input into trailers. On balance this is a real but narrow-surface vulnerability requiring an audit of whether any cpp-httplib deployment reflects attacker data into trailer fields.

An attacker submits a crafted HTTP request to a cpp-httplib 0.49.0 application that echoes a user-supplied value - such as a query parameter or request header - into a chunked response trailer field. The library writes the unsanitized value, containing an embedded sequence such as legit Injected-Header: pwned , directly to the socket, causing the victim's HTTP client or intermediary proxy to parse the injected bytes as a new response header or even a second HTTP response. The commit diff test case (ChunkedTrailerCRLFInjection) serves as a technical proof of concept demonstrating that both field-value and field-name injection are possible, though no standalone weaponized exploit has been published.