C++ HTTP/HTTPS Library Vulnerability in cpp-httplib by Yhirose

CVE-2026-28434

What is CVE-2026-28434?

The cpp-httplib library, a widely used C++11 single-file HTTP/HTTPS framework, has a vulnerability that allows internal exception messages to be leaked in HTTP responses. If a request handler throws an unhandled C++ exception and a custom exception handler is not registered, the library will automatically capture the exception's message and transmit it as an HTTP header named EXCEPTION_WHAT. This occurs without any authentication checks or specific configurations, potentially exposing sensitive internal details to unauthorized clients. Developers using versions before 0.35.0 are urged to upgrade to mitigate this security issue.

References