Critical Security Flaw in cpp-httplib: Exposure of Sensitive Credentials
Summary
DEBIAN-CVE-2026-33745: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.26.0+ds-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library designed for ease of use and integration into various applications. It enables developers to implement HTTP client and server functionalities seamlessly. However, prior to version 0.39.0, cpp-httplib had a significant security vulnerability that allowed the exposure of sensitive authentication credentials during cross-origin HTTP redirects.
Vulnerability Detail
The vulnerability arises from the way cpp-httplib handles HTTP redirects (301/302/307/308). When the HTTP client follows a redirect to an arbitrary host, it forwards stored Basic Auth, Bearer Token, and Digest Auth credentials in the Authorization header. This means that if a malicious or compromised server redirects the client, the attacker can capture these plaintext credentials, leading to potential unauthorized access and data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using cpp-httplib for HTTP requests that may follow redirects to untrusted hosts. Implement additional checks to validate the redirect URL before proceeding with the request.
Conclusion
The cpp-httplib vulnerability allows sensitive credentials to be exposed during HTTP redirects, posing significant security risks. It is crucial to update to version 0.39.0 or later to mitigate this issue and ensure the safety of your applications.
See every vulnerability recorded for cpp-httplib →
FAQ
cpp-httplib is a C++ library that provides HTTP/HTTPS client and server functionalities in a single header file.
All versions prior to 0.39.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include unauthorized access to sensitive information, data breaches, and potential exploitation by attackers.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
