Cross-Origin Cookie Exposure in cpp-httplib - CVE-2026-102944
Summary
DEBIAN-CVE-2026-102944: cpp-httplib is a C++ header-only HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.41.0+ds-3~bpo13+1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++ header-only library designed for HTTP/HTTPS communication. It simplifies the process of making web requests and handling responses, making it a popular choice for developers needing lightweight and efficient networking solutions. However, prior to version 0.51.0, it exhibited a vulnerability that allowed session cookies to be sent to unintended recipients during certain redirect scenarios.
Vulnerability Detail
The vulnerability arises from the create_redirect_client() function in cpp-httplib, which improperly handles HTTP headers during cross-origin redirects (301, 302, 307, or 308). While it removes certain headers like Host and Authorization, it fails to clear Cookie headers. This oversight allows an attacker controlling a redirect response or positioned in a non-HTTPS network to capture session cookies intended for the original origin, potentially leading to session hijacking. Notably, 303 redirects are not affected as they clear all request headers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using cpp-httplib for handling redirects from untrusted sources until the library is updated. Alternatively, consider implementing additional security measures such as cookie flags (HttpOnly, Secure) to mitigate the risk of cookie exposure.
Conclusion
CVE-2026-102944 presents a significant risk for applications using cpp-httplib prior to version 0.51.0, as it allows for the potential exposure of session cookies during cross-origin redirects. Updating to the latest version is crucial to safeguard against this vulnerability.
See every vulnerability recorded for cpp-httplib →
FAQ
CVE-2026-102944 is a vulnerability in cpp-httplib that allows session cookies to be sent to unintended recipients during certain cross-origin redirects.
If your application uses cpp-httplib and handles redirects, it may expose session cookies to attackers, leading to potential session hijacking.
Versions prior to 0.51.0 of cpp-httplib are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing security measures such as setting cookie flags to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
