cpp-httplib CVE-2026-102944

Exploitation requires the consuming application to use a cpp-httplib client (prior to 0.51.0) with redirect-following enabled (set_follow_location(true)) AND to attach a Cookie header either directly or via default_headers_. The leak only occurs on cross-origin 301, 302, 307, or 308 redirects; 303 redirects are NOT affected because that code path clears all request headers, and same-origin redirects legitimately preserve cookies. The attacker must additionally either control the redirect response (e.g., a malicious or compromised destination server) OR occupy a network man-in-the-middle position against a non-HTTPS (plaintext) origin. Limiting factors: no leak against default clients that do not follow redirects or do not send cookies; HTTPS origins resist the MITM variant (leaving only the attacker-controlled-redirect variant); and only Host/Proxy-Authorization/Authorization were previously stripped while Cookie/Cookie2 were not.

This is a credential-leak flaw (CWE-522) rated CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - confidentiality-only, no integrity or availability impact. The high score is driven by the C:H component (session cookies exposed) combined with network vector and no required privileges or user interaction. However, the raw CVSS overstates real-world exposure: exploitation is NOT a default-configuration remote compromise. It requires an application built on cpp-httplib (<0.51.0) that (a) enables follow-location/redirect-following, (b) attaches Cookie headers (directly or via default_headers_), and (c) an attacker who either controls the redirect response or holds a network position against a non-HTTPS origin. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis, and the vulnerability is not in CISA KEV, so there is no evidence of active or widespread exploitation. The signals are internally consistent - a genuine but conditional information-disclosure bug rather than a wormable critical. For most organizations this is a dependency-hygiene/patch item (bump to 0.51.0) rather than an emergency, though the fix is trivial and the leaked data (session cookies) is sensitive, warranting prompt remediation where cpp-httplib clients send cookies across redirects.

An application uses a cpp-httplib client with set_follow_location(true) and sends a session Cookie to its origin. An attacker who controls (or compromises) the destination server, or who can MITM a plaintext HTTP origin, returns a 301/302/307/308 redirect pointing to an attacker-controlled host; the client re-sends the original Cookie header to that cross-origin target, handing the attacker the victim's session credentials. No public exploit code is identified, but the fixed-version test case (DoNotForwardCookie) effectively demonstrates the trigger.