CVE-2026-102944 cpp-httplib: Cookie header leaked on cross-origin redirect

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

CVE-2026-102944

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

EUVD-2026-101592

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

CVE-2026-102944

The cpp-httplib C++ header-only HTTP/HTTPS library is vulnerable to Cookie header leakage during cross-origin redirects. Prior to version 0.51.0 , the create_redirect_client() function fails to remove Cookie headers when following 301, 302, 307, or 308 redirect codes, unlike Host, Proxy-Authoriza...

CVE-2026-102944 cpp-httplib: Cookie header leaked on cross-origin redirect

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

CVE-2026-102944 cpp-httplib: Cookie header leaked on cross-origin redirect

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

CVE-2026-102944

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

CVE-2026-103930: Improper Neutralization of CRLF Sequences in HTTP Headers

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-102944: Insufficiently Protected Credentials

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

PT-2026-113948

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create redirect client removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect copies the request for those...

PT-2026-113960

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open stream in httplib.h accepts a caller-controlled path that reaches detail::write request line without the detail::encode path protection used by the ordinary buffered request path. Raw carriage-return and...

OESA-2026-4093 cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code! Security Fixes: cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names a...

OESA-2026-4094 cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code! Security Fixes: cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names a...

OESA-2026-4092 cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code! Security Fixes: cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names a...

OESA-2026-3961 cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code! Security Fixes: A vulnerability, classified as critical, has been found in yhirose cpp-httplib up to version 0.33.0 and version 0.50.0. This is a CWE-416 Use...

OESA-2026-3801 cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code! Security Fixes: A vulnerability, classified as critical, has been found in yhirose cpp-httplib up to version 0.33.0 and version 0.50.0. This is a CWE-416 Use...

OESA-2026-3800 cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code! Security Fixes: A vulnerability, classified as critical, has been found in yhirose cpp-httplib up to version 0.33.0 and version 0.50.0. This is a CWE-416 Use...

CVE-2026-77341

A flaw was found in cpp-httplib, a C++ HTTP/HTTPS library. This vulnerability allows a remote attacker to inject arbitrary HTTP headers or split HTTP responses by sending specially crafted data within chunked response trailer headers. The library fails to properly validate these headers, enabling...

CVE-2026-77358

A flaw was found in cpp-httplib. The TLS Transport Layer Security-enabled WebSocket client improperly frees a TLS session while the WebSocket connection is still active. This timing issue, which occurs during the normal shutdown of a secure WebSocket connection, leads to a use-after-free...

SUSE CVE-2026-77358

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...