Human
Machine
REPRO-2026-00127 HIGH Request Smuggling
Verified
cpp-httplib HTTP Request Smuggling via Unconsumed GET Request Body
yhirose/cpp-httplib (github) Apr 4, 2026
What's the vulnerability?
cpp-httplib (16.3k+ GitHub stars) is vulnerable to HTTP Request Smuggling in versions ≤0.38.0. The server's static file handler serves GET responses WITHOUT consuming the request body, leaving body bytes on the TCP stream to be interpreted as a new HTTP request on keep-alive connections.
Root Cause Analysis
Variant Analysis
Bypass and alternate trigger exploration (if present).
One Command
Verify with pruva-verify
Run the Pruva CLI to automatically fetch and execute the reproduction script.
pruva-verify REPRO-2026-00127 or
pruva-verify CVE-2026-34441 Install:
curl -fsSL https://pruva.dev/install.sh | sh Or Run Manually
1
Download the script
curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00127/artifacts/repro/reproduction_steps.sh 2
Make executable
chmod +x reproduction_steps.sh 3
Run the script
./reproduction_steps.sh Run in a VM, container, or disposable environment. This exploits a real vulnerability.
How Pruva Reproduced This
Watch the AI agent's step-by-step process.
Loading session...
Artifacts
repro/rca_report.md4.4 KBrepro/reproduction_steps.sh9.7 KBvuln_variant/rca_report.md8.1 KBvuln_variant/reproduction_steps.sh16.6 KBbundle/ticket.json2.7 KBbundle/AGENTS.repro.md0.8 KBbundle/ticket.md2.3 KBrepro/artifacts/python_request.raw0.2 KBrepro/artifacts/exploit_result.json0.4 KBrepro/artifacts/smuggle_response.raw0.2 KBrepro/artifacts/server_v0.40.0.log0.0 KBrepro/artifacts/build_vuln.log0.0 KBrepro/artifacts/test_fixed556.5 KBrepro/artifacts/build_fixed.log0.0 KBrepro/artifacts/library_test.cpp5.5 KBrepro/artifacts/test_vuln554.3 KBrepro/artifacts/server_v0.38.0.log0.0 KBrepro/artifacts/response_v0.38.0.bin0.4 KBrepro/artifacts/final_results.json0.3 KBrepro/artifacts/response_v0.40.0.bin0.2 KBrepro/artifacts/request_hex.txt0.8 KBrepro/artifacts/payload_v0.38.0.bin0.1 KBrepro/artifacts/result_v0.40.0.json0.2 KBrepro/artifacts/response.raw0.2 KBrepro/artifacts/output_vuln.txt0.6 KBrepro/artifacts/result_v0.38.0.json0.2 KBrepro/artifacts/server.log0.0 KBrepro/artifacts/output_fixed.txt0.6 KBrepro/artifacts/smuggle_request.raw0.2 KBrepro/artifacts/payload_v0.40.0.bin0.1 KBrepro/artifacts/results.json0.3 KBrepro/artifacts/request.raw0.2 KBrepro/runtime_manifest.json0.8 KBrepro/validation_verdict.json0.7 KBvuln_variant/variant_manifest.json2.0 KBvuln_variant/source_identity.json1.0 KBvuln_variant/patch_analysis.md6.3 KBvuln_variant/validation_verdict.json2.1 KBlogs/vuln_variant/server_v0.38.0_v5_http10.log0.0 KBlogs/vuln_variant/result_v0.40.0_v3_head.json0.1 KBlogs/vuln_variant/payload_v0.38.0_v4_oversized.log0.0 KBlogs/vuln_variant/test_run.log2.7 KBlogs/vuln_variant/server_v0.40.0_v3_head.log0.0 KBlogs/vuln_variant/server_v0.38.0_v4_oversized.log0.0 KBlogs/vuln_variant/result_v0.38.0_v5_http10.json0.1 KBlogs/vuln_variant/result_v0.40.0_v4_oversized.json0.1 KBlogs/vuln_variant/result_v0.40.0_v2_cl_te.json0.1 KBlogs/vuln_variant/payload_v0.38.0_v2_cl_te.log0.2 KBlogs/vuln_variant/result_v0.38.0_v3_head.json0.1 KBlogs/vuln_variant/result_v0.38.0_v2_cl_te.json0.1 KBlogs/vuln_variant/payload_v0.38.0_v1_get_baseline.log0.1 KBlogs/vuln_variant/payload_v0.38.0_v5_http10.log0.0 KBlogs/vuln_variant/payload_v0.40.0_v2_cl_te.log0.2 KBlogs/vuln_variant/payload_v0.40.0_v1_get_baseline.log0.0 KBlogs/vuln_variant/payload_v0.40.0_v5_http10.log0.0 KBlogs/vuln_variant/final_variant_results.json0.6 KBlogs/vuln_variant/result_v0.38.0_v4_oversized.json0.1 KBlogs/vuln_variant/result_v0.38.0_v1_get_baseline.json0.1 KBlogs/vuln_variant/server_v0.38.0_v1_get_baseline.log0.1 KBlogs/vuln_variant/payload_v0.40.0_v3_head.log0.0 KBlogs/vuln_variant/server_v0.40.0_v4_oversized.log0.0 KBlogs/vuln_variant/server_v0.40.0_v1_get_baseline.log0.0 KBlogs/vuln_variant/build_v0.38.0.log0.0 KBlogs/vuln_variant/server_v0.40.0_v5_http10.log0.0 KBlogs/vuln_variant/server_v0.40.0_v2_cl_te.log0.0 KBlogs/vuln_variant/server_v0.38.0_v2_cl_te.log0.0 KBlogs/vuln_variant/result_v0.40.0_v5_http10.json0.1 KBlogs/vuln_variant/result_v0.40.0_v1_get_baseline.json0.1 KBlogs/vuln_variant/payload_v0.38.0_v3_head.log0.1 KBlogs/vuln_variant/payload_v0.40.0_v4_oversized.log0.0 KBlogs/vuln_variant/server_v0.38.0_v3_head.log0.1 KBlogs/vuln_variant/build_v0.40.0.log0.0 KB