CVE-2026-34441: 
Homebrew vulnerability analysis and mitigation

CVE-2026-34441 is an HTTP Request Smuggling vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. Versions up to and including 0.38.0 are affected; the issue was disclosed on March 31, 2026, and patched in version 0.40.0. The vulnerability arises because the server's static file handler serves GET responses without consuming the request body, allowing unread body bytes on HTTP/1.1 keep-alive connections to be interpreted as a new HTTP request. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, and 4.8 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling) and CWE-501 (Trust Boundary Violation). Two distinct flaws exist: (1) In Server::routing() (line 11580 of httplib.h), when a GET request matches a static file mount point, handle_file_request() returns true immediately without consuming the request body; the keep-alive loop in process_server_socket_core() then detects leftover bytes in the TCP buffer via select_read() and processes them as a new HTTP request. (2) The read_content() function (line 7249) accepts requests containing both Content-Length and Transfer-Encoding headers without rejecting them, violating RFC 9112 §6.3 and enabling CL+TE smuggling variants when the server is deployed behind a reverse proxy. No authentication or special privileges are required; the attacker only needs network access to the server on an HTTP/1.1 keep-alive connection (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to smuggle arbitrary HTTP requests into the server's processing pipeline, effectively causing the server to process two requests where only one was sent. This can lead to access control bypass (smuggled requests circumvent proxy-level authentication), cache poisoning (smuggled responses cached under incorrect URLs in proxy-cache architectures), and request hijacking (a smuggled request can be paired with another user's legitimate request behind a reverse proxy). Confidentiality and integrity are both at low risk per CVSS, with no direct availability impact, though the attack surface expands significantly in multi-tier deployments (GitHub Advisory).

A complete, runnable Python proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating HTTP request smuggling against a live cpp-httplib server instance using raw socket connections. The PoC was confirmed to work against cpp-httplib v0.39.0, successfully smuggling both GET and POST requests. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term (GitHub Advisory).

1. Reconnaissance: Identify servers running cpp-httplib versions ≤0.38.0 that expose HTTP/1.1 endpoints with static file serving enabled. Tools like Shodan or Censys can help identify exposed instances.
2. Establish keep-alive connection: Open a raw TCP socket connection to the target server (e.g., socket.connect((TARGET_HOST, TARGET_PORT))) to leverage HTTP/1.1 keep-alive behavior.
3. Craft the outer GET request: Construct a GET request targeting a static file endpoint (e.g., GET /index.html HTTP/1.1) with a Content-Length header whose value equals the byte length of the smuggled request to be embedded in the body.
4. Send outer request headers only: Transmit the outer GET request headers (without the body) and receive the server's response to /index.html. Confirm the connection remains alive (Connection: Keep-Alive in response).
5. Send the smuggled request as the body: Transmit the smuggled HTTP request (e.g., GET /large.txt HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n) as the body of the outer request. The server's static file handler never consumed the body, so these bytes remain in the TCP buffer.
6. Receive the smuggled response: After a brief delay, read from the socket again. The server's keep-alive loop interprets the body bytes as a new request and responds to the smuggled request independently, confirming successful smuggling.
7. Escalate: In proxy-backend deployments, use this technique to bypass proxy-level access controls, poison caches, or hijack other users' requests by timing the smuggled request to interleave with legitimate traffic (GitHub Advisory).

• Network: HTTP/1.1 GET requests to static file endpoints with a non-zero Content-Length header (unusual for GET); raw TCP connections sending data in two distinct bursts on the same socket; unexpected responses to endpoints not explicitly requested by the client.
• Logs: Server access logs showing two sequential requests on the same connection where the second request's path was not initiated by the client; requests with both Content-Length and Transfer-Encoding headers present simultaneously.
• Application Behavior: Responses to endpoints that were not requested (e.g., a client requesting /index.html but receiving a response for /admin or another resource); cache entries for URLs that were never directly requested by legitimate clients.
• Process/Connection: Unusually long-lived TCP connections with multiple request/response cycles where the client only sent one logical request (GitHub Advisory).

Upgrade cpp-httplib to version 0.40.0 or later, which implements request body consumption before keep-alive connection reuse and rejects requests containing both Content-Length and Transfer-Encoding headers with a 400 Bad Request response (GitHub Release). As a temporary workaround if immediate patching is not possible, disable HTTP/1.1 keep-alive connections on the server to prevent body bytes from being reused as new requests. Additionally, deploying a hardened reverse proxy (e.g., nginx or HAProxy configured to normalize HTTP requests) in front of the cpp-httplib server can mitigate CL+TE smuggling variants (GitHub Advisory).

Red Hat tracked the vulnerability via their security response process (Bugzilla bug 2453582) and classified it as medium severity. OpenSUSE issued a security announcement addressing the vulnerability in their cpp-httplib-devel package, updating to version 0.42.0. The vulnerability was reported by researcher 'thesanjok' and credited in the GitHub Security Advisory. Coverage appeared across vulnerability tracking platforms including VulDB, CVEFeed, and CIRCL's vulnerability database shortly after disclosure (Red Hat Bugzilla, GitHub Advisory).