cpp-httplib CVE-2026-77358

Exploitation requires that the consuming application uses cpp-httplib's TLS WebSocket client (WebSocketClient with a wss:// endpoint) in versions 0.33.0 through 0.50.0. The defect fires on three code paths: (1) the WebSocketClient destructor executing while the WebSocket is still open - i.e., the client object goes out of scope without an explicit close() call; (2) a call to connect() on an already-open client, which internally calls shutdown_and_close on the current connection; (3) a direct call to shutdown_and_close with the WebSocket still open. Plain HTTP, plain HTTPS (non-WebSocket), and unencrypted ws:// connections are not affected. No authentication is required to reach the vulnerable paths, but the vulnerable application must be actively using TLS WebSocket connections - deployments that use cpp-httplib only for HTTP or HTTPS request/response (non-WebSocket) are not exposed.

The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) correctly characterizes the primary risk: network-reachable, unauthenticated availability destruction against any application using TLS WebSocket connections. The AT:P qualifier (attack requirements present) acknowledges that wss:// usage must be in scope - plain HTTP and non-WebSocket HTTPS are unaffected. CVSS shows VC:N and VI:N, limiting the impact to availability; however, the intelligence feed tags include 'Information Disclosure,' which is not reflected in the vector - this discrepancy is unresolved and should be verified against the full GHSA advisory. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified from that signal. KEV is not listed and no standalone POC exists beyond the regression tests shipped in 0.50.1, so the current signal is confirmed-vulnerability-with-patch rather than active exploitation. The most operationally significant risk factor is the header-only, statically compiled nature of the library: vulnerable versions are baked into consuming application binaries and will persist in deployed artifacts until each application is recompiled against 0.50.1, creating a supply-chain lag that extends the effective exposure window beyond the patch release date.

A network server that deliberately drops or cycles a wss:// connection against a client application using cpp-httplib 0.33.0-0.50.0 can cause the client to trigger the use-after-free automatically during reconnection or teardown, crashing the client process. No crafted payload or authentication bypass is needed - the connect() call on the still-open client invokes shutdown_and_close, frees the TLS session, and then writes the WebSocket close frame through the dangling pointer. The regression tests added in 0.50.1 demonstrate both the destructor and reconnect paths reliably reproduce the memory corruption under ASan or Valgrind.