Suse EUVD-2026-17672

cpp-httplib is a C++11 header-only HTTP/HTTPS library commonly used in embedded and standalone HTTP server implementations. The vulnerability stems from improper request body handling in the static file GET response handler, which violates HTTP/1.1 semantics (RFC 7230) requiring complete body consumption before pipelining. CWE-444 (Improper Restriction of Rendered UI Layers or Frames) maps to a broader category of request/response protocol handling flaws. The root cause is that when serving static files via GET requests, the handler does not read and discard the request body before returning the response. On keep-alive connections, this leaves unconsumed bytes on the TCP socket, which HTTP/1.1 clients interpret as the start of the next request in the pipeline. An attacker can craft a GET request with a body containing a fully-formed HTTP request (e.g., POST to /admin, HEAD to sensitive endpoints), which the server then processes as a legitimate second request.