Read the docs
TI-2026-74409 Aliases CVE-2026-102944

cpp-httplib leaks Cookie headers on cross-origin redirect

Priority HIGH 72CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

cpp-httplib, a C++ header-only HTTP/HTTPS library, is affected before 0.51.0. When following a cross-origin 301, 302, 307, or 308 redirect, create_redirect_client() removes the Host, Proxy-Authorization, and Authorization headers but leaves Cookie headers attached, and detail::redirect() copies the request for those codes, so cookies set directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or who has a network position on a non-HTTPS origin, can receive session cookies meant for the original origin. A 303 redirect is not affected because that path clears all request headers.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed cpp-httplib (yhirose): 0.51.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yhirosecpp-httplibbefore 0.51.00.51.0Patch availableCNA
  • cpp-httplib Vendoryhirose Affected before 0.51.0 Fixed in 0.51.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*——yhirose
  • cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:* Versions — — ·yhirose

Remediation

Update cpp-httplib to version 0.51.0 or later. The sources list no fixed version in the affected data, but the advisory states the issue is fixed in 0.51.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA cpp-httplib (yhirose) Fixed in 0.51.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-102944
  2. 2026-10-15 CISA SSVC decision points changed
  3. 2026-10-15 Priority changed: MEDIUM → HIGH
  4. 2026-10-16 Affected versions changed · Red Hat
  5. 2026-10-16 CVSS score added · Red Hat

References

Other 3

  • TI-2026-33163 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection CVSS 3.1CRITICAL 9.9
  • TI-2026-53978 cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close() CVSS 4.0HIGH 8.2
  • TI-2026-18294 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb CVSS 4.0HIGH 8.7
  • TI-2026-17313 cpp-httplib has CRLF injection in http headers CVSS 4.0HIGH 7.7
  • TI-2026-33146 cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding CVSS 3.1HIGH 7.5
  • TI-2026-22709 Uncontrolled resource consumption in yhirose cpp-httplib CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences