EUVD-2026-12137Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker intercepts initial HTTP request
-
ExploitReturns redirect to attacker-controlled HTTPS server
-
Executioncpp-httplib client follows redirect with disabled certificate verification
-
ImpactAttacker performs MITM attack and steals sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | cpp-httplib client with proxy configuration enabled AND set_follow_location(true) enabled AND application follows HTTPS redirects. Requires network position to intercept and respond with redirect. |
| Impact | Despite the high CVSS score (8.7), real-world risk appears moderate. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) indicates network-based attack requiring high complexity - specifically positioning to intercept proxy traffic and inject redirects. No KEV listing suggests no known active exploitation. EPSS data unavailable but typically low for library vulnerabilities. The 'Changed Scope' metric inflates the score as compromised connections affect resources beyond the vulnerable component. Priority should be based on whether applications use proxy+redirect configurations rather than raw CVSS. |
| Exploit ScenarioDerived | An attacker positioned between the client and proxy server (or controlling a malicious proxy) waits for HTTPS requests. When receiving a request, they respond with an HTTP redirect to an attacker-controlled HTTPS server presenting an invalid certificate. The cpp-httplib client silently accepts this certificate and establishes an encrypted connection with the attacker's server, allowing full interception of sensitive data like authentication tokens or API keys. No public POC exists, requiring sophisticated network positioning to exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
cpp-httplib versions before 0.37.2 silently disable TLS certificate validation when following HTTPS redirects through a proxy, allowing attackers to intercept encrypted connections without detection. This affects any application using cpp-httplib as an HTTP client with proxy and redirect following enabled. No active exploitation (not in KEV) or public POC has been reported, with low EPSS probability indicating minimal current threat activity.
RemediationAI
Upgrade to cpp-httplib version 0.37.2 or later, which fixes the certificate validation issue. For applications unable to upgrade immediately, disable either proxy usage or set_follow_location(false) to prevent the vulnerable code path. Review the vendor advisory at https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g for detailed patch information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cpp-httplib is a lightweight, header-only C++11 HTTP/HTTPS library (CPE: cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*). The vulnerability stems from improper certificate validation (CWE-295) when the client is configured with both a proxy server and set_follow_location(true). During HTTPS redirects, the library fails to maintain TLS security checks on the redirected connection, accepting any certificate including expired, self-signed, or attacker-controlled certificates without warning.
Know when Cpp Httplib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target - expired, self-signed, or forged - without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.
Executive ViewAI
cpp-httplib versions before 0.37.2 silently disable TLS certificate validation during HTTPS redirects through proxies, creating a man-in-the-middle exposure for any application using this library as an HTTP client. Organizations using cpp-httplib with proxy and redirect features enabled risk undetected interception of encrypted communications, potentially exposing sensitive data in transit.
Apply vendor patch (upgrade to cpp-httplib 0.37.2 or later). If immediate patching is not feasible, disable proxy-based HTTPS redirect following in affected applications and route traffic through a dedicated TLS-terminating proxy with independent certificate validation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Cpp Httplib
View allcpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allow
CVE-2025-53628 is a memory exhaustion vulnerability in cpp-httplib versions prior to 0.20.1 that allows unauthenticated
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Rated high severity (CVSS 7.5), this vulnerabilit
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http head
CVE-2025-53629 is a Denial of Service vulnerability in cpp-httplib versions prior to 0.23.0 that allows unauthenticated
cpp-httplib versions prior to 0.30.1 are vulnerable to denial of service attacks due to insufficient validation of decom
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. [CVSS 7.5 HIGH]
Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request bo
cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, whic
HTTP response/header injection in cpp-httplib server versions prior to 0.44.0 allows remote unauthenticated attackers to
Remote denial of service in cpp-httplib prior to version 0.37.0 allows unauthenticated attackers to crash server process
A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public Po
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
Exploit-DB