Hi,

The following vulnerability was published for cpp-httplib.

CVE-2026-77341[0]:
| cpp-httplib is a C++ header-only HTTP/HTTPS library. In version
| 0.49.0, the chunked-response trailer output path writes trailer
| header names and values directly to the socket without validating
| them, allowing CRLF sequences in a trailer field to inject
| additional headers or split the HTTP response. Unlike every other
| header-writing path in the library, the trailer-writing code applies
| none of the field-name and field-value checks that reject carriage
| return and line feed, so an application that places attacker-
| influenced data into a chunked response trailer emits attacker-
| controlled CRLF onto the wire. This enables HTTP response splitting,
| letting an attacker forge response headers or inject a second
| response. This issue is fixed in version 0.50.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-77341
https://www.cve.org/CVERecord?id=CVE-2026-77341
[1] https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c
[2] https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore