Read the docs
TI-2026-53978 Aliases CVE-2026-77358

cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()

Priority HIGH 77CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Fix Fixed cpp-httplib (yhirose): 0.50.

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yhirosecpp-httplib0.33.0 to before 0.50.0.50.Patch availableCNA
  • cpp-httplib Vendoryhirose Affected 0.33.0 to before 0.50. Fixed in 0.50. Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*——yhirose
  • cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:* Versions — — ·yhirose

Remediation

  • Fix · CNA cpp-httplib (yhirose) Fixed in 0.50.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77358

References

Other 2

  • TI-2026-33163 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection CVSS 3.1CRITICAL 9.9
  • TI-2026-18294 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb CVSS 4.0HIGH 8.7
  • TI-2026-17313 cpp-httplib has CRLF injection in http headers CVSS 4.0HIGH 7.7
  • TI-2026-74409 cpp-httplib leaks Cookie headers on cross-origin redirect CVSS 3.1HIGH 7.5
  • TI-2026-33146 cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding CVSS 3.1HIGH 7.5
  • TI-2026-22709 Uncontrolled resource consumption in yhirose cpp-httplib CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences