Use-After-Free Vulnerability in cpp-httplib Package Affects WebSocket Client
Summary
DEBIAN-CVE-2026-77358: cpp-httplib is a C++ header-only HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.41.0+ds-3~bpo13+1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++ header-only library designed for HTTP and HTTPS communication. It provides a simple interface for creating web servers and clients, making it a popular choice for developers needing lightweight and efficient networking solutions. However, versions 0.33.0 through 0.50.0 are susceptible to a critical vulnerability that affects the WebSocket client functionality.
Vulnerability Detail
In cpp-httplib versions 0.33.0 through 0.50.0, a use-after-free vulnerability exists in the TLS-enabled WebSocket client. The issue arises when the TLS session is freed before the WebSocket connection is properly closed. Specifically, in the WebSocketClient::shutdown_and_close method, the SSL object is deallocated, leaving a dangling pointer. Subsequent operations on the WebSocket attempt to send a close frame through the now-invalid SSL socket, leading to potential memory corruption and undefined behavior. This vulnerability can be exploited during normal teardown of a secure WebSocket connection, posing significant risks to application stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of the WebSocket client in affected versions until the package can be updated. Alternatively, you may implement additional checks to ensure that the WebSocket connection is properly managed and closed before freeing the TLS session.
Conclusion
The cpp-httplib package has a critical use-after-free vulnerability affecting its WebSocket client in versions 0.33.0 through 0.50.0. Users are strongly advised to update to version 0.50.1 or later to mitigate potential risks. For those unable to update immediately, temporary workarounds should be considered to ensure application stability.
See every vulnerability recorded for cpp-httplib →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory resource after it has been freed, potentially leading to memory corruption and security risks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Exploiting this vulnerability can lead to application crashes, data corruption, or even remote code execution, depending on how the affected software is used.
Yes, the vulnerability has been fixed in version 0.50.1 of cpp-httplib. It is recommended to update to this version or later.
If an immediate update is not possible, consider implementing workarounds such as avoiding the use of the WebSocket client in the affected versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
