Cpp Httplib EUVD-2026-17672

CVSS 4.8 with network vector (AV:N), high complexity (AC:H), and no privilege or user interaction required reflects moderate risk. The AC:H indicates difficulty triggering the condition reliably, likely due to timing sensitivity on keep-alive connections and server-side buffering behavior. EPSS and KEV status are not provided in available intelligence, so real-world exploitation rates cannot be assessed directly. However, HTTP Request Smuggling (CWE-444) is a well-understood attack class with published techniques; the difficulty (AC:H) suggests this specific variant may require specific server configurations or connection handling. The impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact, and it cannot escalate privileges (S:U). For security-conscious deployments using cpp-httplib in HTTP/1.1 mode with static file serving, this is a meaningful but not critical issue. Organizations deploying HTTP/2 or HTTP/3 are not affected, as those protocols eliminate request smuggling via framing. Risk priority depends on exposure: internal APIs or edge services are lower risk; publicly-facing APIs serving untrusted clients warrant immediate patching.

An attacker sends a single HTTP/1.1 GET request to fetch a static file (e.g., /static/image.png), but includes a fully-formed HTTP request in the request body-for example, a POST to /admin/settings. The vulnerable server's static file handler returns the GET response without consuming the body bytes. Because the connection remains open (keep-alive), the unread body (the injected POST request) remains on the TCP stream. The server's HTTP parser interprets it as a new, legitimate incoming request and processes the POST. The attacker can thus perform actions (changing settings, querying databases, accessing protected endpoints) that would normally require direct authentication, bypassing single-request security controls. High AC:H complexity suggests the attacker must carefully control timing or leverage specific server buffering behavior to reliably trigger the condition.