cpp‑httplib’s default exception handling writes the exception message directly into an HTTP response header named EXCEPTION_WHAT. This exposes internal error details to any client that makes a request, potentially revealing sensitive information about the application or environment. The weakness corresponds to CWE‑200, an information‑disclosure vulnerability.

The vulnerability affects all releases of yhirose:cpp‑httplib prior to version 0.35.0. Any application that includes the library without registering a custom exception handler is potentially exposed.

The CVSS score of 5.3 indicates a medium severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the leak by sending any HTTP request to the server; no authentication or special configuration is required.