CVE-2026-54919 Details

A vulnerability exists in cpp-httplib, a cross-platform HTTP/HTTPS library for C++11, specifically in versions 0.31.0 prior to 0.47.0. When built with Mbed TLS or wolfSSL support, the library fails to properly validate SSL certificates for IP-literal hosts when server certificate verification is enabled. This oversight allows a man-in-the-middle attacker to intercept and manipulate traffic by presenting a fraudulent certificate. The issue arises because the Mbed TLS and wolfSSL backends disable proper certificate chain validation for IP addresses during the handshake, leaving only a post-handshake identity check, which can be easily exploited.

Users can upgrade to cpp-httplib version 0.47.0 or later, where this vulnerability has been fixed. If an upgrade is not possible, the OpenSSL backend can be used instead, or connections can be made using a DNS hostname rather than an IP literal. If a fixed IP address must be used, the 'set_hostname_addr_map()' function can be employed to associate the hostname with the IP address while maintaining full certificate verification.