Use-After-Free Vulnerability in C++ Header-Only HTTP Library cpp-httplib
CVE-2026-77358

8.2HIGH

Key Information:

Vendor

Yhirose

Status
Cpp-httplib
Vendor
CVE Published:
27 August 2026

What is CVE-2026-77358?

The cpp-httplib library, a widely-used C++ header-only HTTP/HTTPS library, has a significant use-after-free vulnerability affecting its TLS-enabled WebSocket client. In specific versions, the library incorrectly manages memory during the shutdown of a WebSocket connection, leading to potential exploitation. Specifically, when the WebSocket client attempts to close while still using the TLS session, it incorrectly frees the SSL object while the WebSocket is still active. This can cause errors as the system attempts to read from or write to the now-dangling pointer, posing security risks during the teardown process of secure connections. The vulnerability has been addressed in version 0.50.1, urging users to upgrade promptly to mitigate associated risks.

Affected Version(s)

cpp-httplib >= 0.33.0, < 0.50.

References

https://github.com/yhirose/cpp-httplib/security/advisorie...
x_refsource_CONFIRM
https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.