CyberRota Analysis
AI-GeneratedThe cpp-httplib library version 0.49.0 is vulnerable due to improper validation of chunked-response trailer headers, allowing attackers to inject CRLF sequences that can lead to HTTP response splitting. This vulnerability can enable the forging of response headers or the injection of a second response, potentially compromising the integrity of web applications. Developers and organizations using this library should prioritize upgrading to version 0.50.0 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.