The vulnerability exists in the process that writes chunked-response trailers in the cpp‑httplib library. The code writes the trailer field names and values directly to the socket without any validation of CRLF characters that normally must be rejected. If an attacker can influence the value of a trailer header, the library will send raw CRLF characters, enabling an attacker to split the HTTP response. This permits forging additional headers or creating a second, separate response, which can lead to cross-site scripting, cookie poisoning, or redirect attacks. The weakness aligns with CWE‑113 (HTTP Response Splitting) and CWE‑93 (Improper Handling of URL or Path Segments).

The affected component is the header‑only C++ library yhirose:cpp‑httplib. The issue was present in version 0.49.0; it was fixed in version 0.50.0, which adds proper validation for trailer header names and values. All deployments using 0.49.0 that send chunked responses with trailer headers are vulnerable.

The CVSS base score is 5.3, indicating a medium severity. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to supply data that becomes part of a chunked response trailer, which usually means the server application must reflect user input into such trailers. The lack of validation makes the exploit easier compared to libraries that enforce RFC compliance, but a successful exploit still requires client support for chunked transfer encoding. The overall risk is moderate, but due to the potential for severe downstream attacks, timely remediation is recommended.