The vulnerability in the cpp‑httplib library causes the static file handler to return GET responses without consuming the request body. When a keep‑alive connection is used, the unread body bytes remain on the TCP stream and are later interpreted as the start of a new HTTP request. An attacker can embed an arbitrary HTTP request inside the body of a GET request, which the server processes as a separate request. This flaw results in HTTP Request Smuggling, allowing unintended request handling by the server.

The issue affects any installation of the yhirose:cpp‑httplib library prior to version 0.40.0. The library is a C++11 single-file header‑only cross‑platform HTTP/HTTPS library that may be used in custom web servers or backend services handling HTTP or HTTPS traffic.

The CVSS score of 4.8 classifies the vulnerability as moderate severity. With an EPSS score below 1% and no listing in the CISA KEV catalog, the likelihood of widespread exploitation appears low. The attack vector is remote; an adversary only needs to send a crafted HTTP request over a keep‑alive connection, without requiring authentication or elevated privileges. The vulnerability stems solely from improper consumption of the request body by the library’s static file handler.