CVE-2026-102944 Details
Description
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.
A vulnerability in cpp-httplib, a C++ header-only HTTP/HTTPS library, allows for the unintentional leakage of session cookies during cross-origin HTTP redirects. This issue affects versions prior to 0.51.0. When the library's 'create_redirect_client()' function handles redirects (specifically 301, 302, 307, and 308), it correctly removes certain headers such as 'Host' and 'Authorization'. However, it fails to strip 'Cookie' headers, which are then forwarded to the new location. This oversight can be exploited by an attacker who controls the redirect response or is in a position to intercept non-HTTPS traffic, allowing them to access session cookies meant for the original domain.
Users can upgrade to cpp-httplib version 0.51.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585 | [email protected] | Source CodeVendor |
| https://github.com/yhirose/cpp-httplib/releases/tag/v0.51.0 | [email protected] | Release NotesVendor |
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cpp-httplib | 0.50.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |