Information disclosure in Cpp-httplib - CVE-2026-33745

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127465

Information disclosure in Cpp-httplib - CVE-2026-33745

Published: April 24, 2026


Vulnerability identifier: #VU127465
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33745
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive credentials to an unauthorized host.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in ClientImpl::redirect() and redirect credential handling when following cross-origin HTTP redirects. A remote attacker can trigger a redirect to an attacker-controlled host to disclose sensitive credentials to an unauthorized host.

Requests are affected when redirect following is enabled and stored Basic Auth, Bearer Token, or Digest Auth credentials are configured. Cross-origin redirects may also cause credentials to be sent after an HTTPS-to-HTTP downgrade.


Affected software

Cpp-httplib
Fedora
openEuler
cpp-httplib-debuginfo
cpp-httplib-devel
cpp-httplib-debugsource
cpp-httplib

How to mitigate CVE-2026-33745

Install security update from vendor's website.

Cpp-httplib - update to 0.39.0
cpp-httplib-debuginfo - update to 0.40.0-1
cpp-httplib-devel - update to 0.40.0-1
cpp-httplib-debugsource - update to 0.40.0-1
cpp-httplib - update to 0.40.0-1
cpp-httplib - addressed in versions 0.48.0-1.el9, 0.48.0-1.el10_3, 0.48.0-1.fc43, 0.48.0-1.fc44

External References

Related Security Bulletins