{"id":"CVE-2026-32627","aliases":["DEBIAN-CVE-2026-32627","EUVD-2026-12137","GHSA-c3h8-fqq4-xm4g","OESA-2026-1637","OESA-2026-1638","OESA-2026-1639","OESA-2026-1640","UBUNTU-CVE-2026-32627","openSUSE-SU-2026:10435-1"],"status":"published","title":"cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy","description":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.002,"percentile":0.09962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-03-13T20:48:14Z","modified":"2026-11-04T20:04:05Z","fixes":[{"ecosystem":"Debian:14","package":"cpp-httplib","fixed_in":["0.41.0+ds-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.4+ds-1","0.11.4+ds-1+deb12u1","0.11.4+ds-2","0.11.4+ds-3","0.13.1+ds-1","0.14.0+ds-1","0.14.1+ds-1","0.14.1+ds-2","0.14.2+ds-1","0.14.3+ds-1","0.14.3+ds-1.1","0.14.3+ds-1.1~exp1","0.15.3+ds-1","0.15.3+ds-2","0.15.3+ds-3","0.16.0+ds-1","0.16.3+ds-1","0.16.3+ds-2","0.18.0+ds-1","0.18.7-1","0.20.1+ds-3","0.25.0+ds-1","0.26.0+ds-2","0.41.0+ds-1","0.41.0+ds-2","0.41.0+ds-3","0.41.0+ds-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.7-1","0.18.7-1+deb13u1","0.20.1+ds-3","0.25.0+ds-1","0.26.0+ds-2","0.41.0+ds-1","0.41.0+ds-2","0.41.0+ds-3","0.41.0+ds-3~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0+ds-3"}]}],"versions":["0.18.7-1","0.20.1+ds-3","0.25.0+ds-1","0.26.0+ds-2","0.41.0+ds-1","0.41.0+ds-2","0.41.0+ds-3~bpo13+1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.7-1","0.18.7-1ubuntu0.25.10.1","0.18.7-1ubuntu0.25.10.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.0+ds-2ubuntu3","0.26.0+ds-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.7-1","0.26.0+ds-2ubuntu2","0.26.0+ds-2ubuntu3","0.26.0+ds-2ubuntu3+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cpp-httplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.0-1.1"}]}],"bundled":6}],"products":[{"vendor":"yhirose","product":"cpp-httplib"}],"references":[{"url":"https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32627.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32627","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-32627","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31870","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1638","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1639","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1640","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-32627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32627","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32627","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-32627","title":"cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy","description":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.","status":"published","published":"2026-03-13T20:48:14.442Z","modified":"2026-03-16T15:41:05.578Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-12137","description":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.","status":"published","published":"2026-03-13T20:48:14Z","modified":"2026-03-16T15:41:05Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:34.078511Z"}],"nvd":[{"id":"CVE-2026-32627","description":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.","status":"published","published":"2026-03-16T14:19:40.27Z","modified":"2026-06-17T10:36:07.623Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-32627","title":"cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy","description":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.","status":"published","published":"2026-03-13T20:48:14.442Z","modified":"2026-10-28T02:31:08.179161843Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-32627","description":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.","status":"published","published":"2026-03-16T14:19:40.27Z","modified":"2026-10-01T03:03:10.325826768Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"OESA-2026-1637","title":"cpp-httplib security update","description":"A C++11 single-file header-only cross platform HTTP/HTTPS library. It\u0026amp;apos;s extremely easy to setup. Just include httplib.h file in your code!\r\n\r\nSecurity Fix(es):\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.1, when a cpp-httplib client uses the streaming API (such as httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions — can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in version 0.37.1.(CVE-2026-31870)\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.(CVE-2026-32627)","status":"published","published":"2026-03-20T11:10:40Z","modified":"2026-08-18T01:19:40.35013942Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1638","title":"cpp-httplib security update","description":"A C++11 single-file header-only cross platform HTTP/HTTPS library. It\u0026amp;apos;s extremely easy to setup. Just include httplib.h file in your code!\r\n\r\nSecurity Fix(es):\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.1, when a cpp-httplib client uses the streaming API (such as httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions — can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in version 0.37.1.(CVE-2026-31870)\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.(CVE-2026-32627)","status":"published","published":"2026-03-20T11:10:40Z","modified":"2026-08-18T01:19:40.436749356Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1639","title":"cpp-httplib security update","description":"A C++11 single-file header-only cross platform HTTP/HTTPS library. It\u0026amp;apos;s extremely easy to setup. Just include httplib.h file in your code!\r\n\r\nSecurity Fix(es):\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.1, when a cpp-httplib client uses the streaming API (such as httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions — can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in version 0.37.1.(CVE-2026-31870)\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.(CVE-2026-32627)","status":"published","published":"2026-03-20T11:10:40Z","modified":"2026-08-18T01:19:41.305274583Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1640","title":"cpp-httplib security update","description":"A C++11 single-file header-only cross platform HTTP/HTTPS library. It\u0026amp;apos;s extremely easy to setup. Just include httplib.h file in your code!\r\n\r\nSecurity Fix(es):\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.1, when a cpp-httplib client uses the streaming API (such as httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions — can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in version 0.37.1.(CVE-2026-31870)\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.(CVE-2026-32627)","status":"published","published":"2026-03-20T11:10:40Z","modified":"2026-08-18T01:19:41.062480397Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"UBUNTU-CVE-2026-32627","description":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.","status":"published","published":"2026-03-16T14:19:00Z","modified":"2026-11-04T20:04:05.77871375Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T21:44:01.347605Z"},{"id":"openSUSE-SU-2026:10435-1","title":"cpp-httplib-devel-0.38.0-1.1 on GA media","description":"These are all security issues fixed in the cpp-httplib-devel-0.38.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-26T00:00:00Z","modified":"2026-03-27T08:48:33.148166Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}