TLS Certificate Validation Bypass in cpp-httplib by Yhirose

CVE-2026-32627

What is CVE-2026-32627?

The cpp-httplib library, a popular C++11 cross-platform HTTP/HTTPS library, has a vulnerability that affects clients configured with a proxy and set to follow redirects. In versions prior to 0.37.2, these clients fail to verify TLS certificates and hostnames when following HTTPS redirects, allowing attackers to exploit this flaw by intercepting connections and serving malicious certificates. As a result, sensitive data, including credentials and session tokens, can be compromised without raising any error or alerting the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References