Use-after-free in Cpp-httplib - CVE-2026-77358
Published: August 25, 2026
Vulnerability identifier: #VU145121
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77358
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to use-after-free in WebSocketClient::shutdown_and_close() when closing a TLS WebSocket connection. A local user can trigger teardown of a crafted wss:// session to cause a denial of service and potentially execute arbitrary code.
The issue is reachable through the public WebSocketClient API and requires SSL support with an open TLS WebSocket connection at teardown or reconnect.
Affected software
Cpp-httplib
openEuler
cpp-httplib
cpp-httplib-debuginfo
cpp-httplib-debugsource
cpp-httplib-devel
openEuler
cpp-httplib
cpp-httplib-debuginfo
cpp-httplib-debugsource
cpp-httplib-devel
How to mitigate CVE-2026-77358
Install security update from vendor's website.
Cpp-httplib - update to 0.50.1
cpp-httplib - update to 0.46.0-2
cpp-httplib-debuginfo - update to 0.46.0-2
cpp-httplib-debugsource - update to 0.46.0-2
cpp-httplib-devel - update to 0.46.0-2
cpp-httplib - update to 0.46.0-2
cpp-httplib-debuginfo - update to 0.46.0-2
cpp-httplib-debugsource - update to 0.46.0-2
cpp-httplib-devel - update to 0.46.0-2