HTTP Request Smuggling Vulnerability in cpp-httplib C++ Library
CVE-2026-34441

4.8MEDIUM

Key Information:

Vendor

Yhirose

Status
Cpp-httplib
Vendor
CVE Published:
31 March 2026

What is CVE-2026-34441?

The cpp-httplib library, a widely used single-file header-only C++ library for HTTP/HTTPS communication, is susceptible to an HTTP Request Smuggling attack. In versions prior to 0.40.0, the library's static file handler incorrectly processes GET responses by failing to consume the request body, which allows leftover bytes in the TCP stream to trigger the interpretation of a new HTTP request. This vulnerability enables attackers to embed malicious HTTP requests within the GET request body, leading to unauthorized request processing by the server. The issue has been addressed in the 0.40.0 update, which mitigates the risks associated with this vulnerability.

Affected Version(s)

cpp-httplib < 0.40.0

References

https://github.com/yhirose/cpp-httplib/security/advisorie...
x_refsource_CONFIRM
https://github.com/yhirose/cpp-httplib/releases/tag/v0.40.0
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.