Source: cpp-httplib Version: 0.41.0+ds-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for cpp-httplib. CVE-2026-77341[0]: | cpp-httplib is a C++ header-only HTTP/HTTPS library. In version | 0.49.0, the chunked-response trailer output path writes trailer | header names and values directly to the socket without validating | them, allowing CRLF sequences in a trailer field to inject | additional headers or split the HTTP response. Unlike every other | header-writing path in the library, the trailer-writing code applies | none of the field-name and field-value checks that reject carriage | return and line feed, so an application that places attacker- | influenced data into a chunked response trailer emits attacker- | controlled CRLF onto the wire. This enables HTTP response splitting, | letting an attacker forge response headers or inject a second | response. This issue is fixed in version 0.50.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-77341 https://www.cve.org/CVERecord?id=CVE-2026-77341 [1] https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c [2] https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d Please adjust the affected versions in the BTS as needed. Regards, Salvatore
