Critical Man-in-the-Middle Vulnerability in cpp-httplib Package
Summary
DEBIAN-CVE-2026-54919: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.41.0+ds-3~bpo13+1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library designed for simplicity and ease of use. It allows developers to integrate HTTP functionalities into their applications seamlessly. However, certain versions of cpp-httplib are vulnerable to a critical security flaw that compromises the integrity of SSL/TLS connections when specific backends are used.
Vulnerability Detail
The vulnerability arises in cpp-httplib when built with Mbed TLS or wolfSSL support, specifically in versions from 0.31.0 to 0.46.1. When a client connects to an IP-literal host with server certificate verification enabled, the library fails to validate the certificate chain properly. This oversight allows a man-in-the-middle attacker to intercept traffic and present a forged certificate, enabling them to read or modify the data being transmitted. The potential ramifications include unauthorized access to sensitive information and data manipulation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable server certificate verification in your application. However, this is not recommended as it exposes your application to potential security risks. If you must implement this, you can modify your connection settings to skip certificate validation, but be aware of the implications.
Conclusion
The cpp-httplib package has a critical vulnerability that can lead to severe security risks if not addressed. It is essential to update to the patched version 0.47.0 or later to ensure the integrity of your application's communications. Utilize tools like Vulert to monitor for vulnerabilities and keep your software secure.
See every vulnerability recorded for cpp-httplib →
FAQ
cpp-httplib is a C++ library that provides easy-to-use HTTP/HTTPS functionalities for applications.
Versions from 0.31.0 to 0.46.1 are affected when built with Mbed TLS or wolfSSL support.
A man-in-the-middle attack occurs when an attacker intercepts communication between two parties, allowing them to eavesdrop or alter the information being exchanged.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can receive real-time alerts about vulnerabilities.
If an immediate update is not possible, consider implementing temporary workarounds such as disabling certificate verification, but be cautious of the security risks involved.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
