Description
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1.
Published: 2026-08-27
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

cpp‑httplib releases its TLS session before the WebSocket close frame is sent, which results in a use‑after‑free that can corrupt memory or enable code execution. The flaw is triggered during normal teardown of a secure socket and is rated 8.2 by CVSS, indicating a high‑consequence vulnerability.

Affected Systems

The bug exists in yhirose:cpp-httplib versions 0.33.0 through 0.50.0. Any deployment that includes the header‑only library in client code that opens TLS‑enabled WebSockets is potentially affected.

Risk and Exploitability

The vulnerability carries a high CVSS score of 8.2 and an unavailable EPSS, meaning current exploit data is not published. Because the flaw manifests when a client performs a typical shutdown sequence, it can be triggered remotely if an attacker can establish a TLS WebSocket connection. The defect is not listed in the CISA KEV catalog, suggesting no public evidence of widespread exploitation yet. Nonetheless, the use‑after‑free can allow arbitrary code execution or memory corruption, warranting immediate attention.

Generated by OpenCVE AI on August 28, 2026 at 07:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the cpp‑httplib library to version 0.50.1 or later where the TLS session is managed correctly.
  • Ensure that WebSocket connections are correctly closed before any TLS session is destroyed; adjust code to retain the session until the close frame is sent.
  • If a library upgrade is not possible, replace TLS‑enabled WebSocket usage with non‑TLS connections or disable TLS in the client until a patch is applied.

Generated by OpenCVE AI on August 28, 2026 at 07:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
First Time appeared Yhirose
Yhirose cpp-httplib
Vendors & Products Yhirose
Yhirose cpp-httplib

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1.
Title cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()
Weaknesses CWE-416
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Yhirose Cpp-httplib
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-27T22:37:14.339Z

Reserved: 2026-08-20T19:28:35.245Z

Link: CVE-2026-77358

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T00:18:15.790

Modified: 2026-08-28T00:18:15.790

Link: CVE-2026-77358

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T07:45:04Z

Weaknesses