cpp-httplib CVE-2026-54919

Exploitation requires all of the following concrete conditions: the target application must be compiled with CPPHTTPLIB_MBEDTLS_SUPPORT (Mbed TLS backend, versions 0.31.0-0.46.1) or CPPHTTPLIB_WOLFSSL_SUPPORT (wolfSSL backend, versions 0.33.0-0.46.1); the client (SSLClient/Client in HTTPS mode, or WebSocketClient on Mbed TLS) must connect to an IP-literal host rather than a DNS hostname; server certificate verification must be enabled (the bug is that it is silently skipped anyway); and the attacker must occupy a man-in-the-middle position able to intercept and relay the victim's traffic. Limiting factors: the OpenSSL backend and non-IP-literal (hostname) connections are not affected, no authentication is needed by the attacker (PR:N) but the required interception position accounts for AC:H, and no user interaction is required.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4 High) is internally consistent with a MITM certificate-validation bypass: no authentication or user interaction is required, but AC:H correctly reflects the precondition that the attacker must already hold a privileged network position to intercept traffic. Impact is high to both confidentiality and integrity (read and modify traffic) with no availability impact. No EPSS score, KEV listing, POC, or SSVC decision data was provided; treat exploitation probability as unquantified rather than low. The practical risk is gated by two non-default conditions - the build must use the Mbed TLS or wolfSSL backend, and the client must connect by IP literal - which meaningfully narrows the affected population below the library's overall install base. This is a genuine authentication-integrity issue for the affected configuration rather than an inflated high-CVSS score, but it is opportunistic/positional, not remotely mass-exploitable.

An attacker who can position themselves on the network path (rogue Wi-Fi, ARP/DNS spoofing, or a compromised upstream hop) waits for a cpp-httplib client built with the Mbed TLS or wolfSSL backend to make an HTTPS or WebSocket connection to a server addressed by IP literal. The attacker terminates the TLS session with a self-signed or otherwise untrusted certificate, which the client accepts without chain validation, letting the attacker transparently read and modify API credentials, tokens, or payloads. No public POC is currently identified, but the technique is standard MITM interception once the vulnerable configuration is in use.