CVE-2026-77358 yhirose CVE debrief

Who should care

Users of cpp-httplib versions 0.33.0 through 0.50.0 should be aware of this vulnerability and take action to mitigate it. This includes updating to version 0.50.1 or later, reviewing and verifying the version of cpp-httplib in use, and monitoring for potential exploitation attempts. Operators, platform administrators, vulnerability management teams, and security teams should review the affected scope and take necessary actions to protect their systems. Compensating controls should be considered for exposed systems while remediation is scheduled and verified. Monitoring and detection capabilities should be reviewed to ensure they can identify potential exploitation attempts. Asset inventory and change management processes should also be updated to account for this vulnerability. Rollback and change window planning should consider the potential impact of this vulnerability on business operations. Source tracking and incident response planning should also be reviewed to ensure readiness in case of an exploitation event. Defensive priority is high due to the HIGH CVSS score of 8.2, indicating a high level of severity. Therefore, immediate action is required to mitigate the vulnerability and prevent potential exploitation. The vulnerability management team should track exceptions, retest remediated assets, and close the item only after evidence is documented. The security team should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs should be checked for exposed assets that need extra review. The security team should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. The team should review compensating controls for exposed systems while remediation is scheduled and verified. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review. Exceptions

Technical summary

The cpp-httplib library, a C++ header-only HTTP/HTTPS library, has a use-after-free vulnerability in its TLS-enabled WebSocket client. Versions 0.33.0 through 0.50.0 are affected. The vulnerability occurs when the TLS session is freed before the WebSocket is closed, leading to a use-after-free error. This issue is fixed in version 0.50.1. The vulnerability can be triggered through the client's destructor and its connect path, making ordinary teardown of a secure WebSocket connection a potential trigger for the defect.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 8.2. Users of cpp-httplib versions 0.33.0 through 0.50.0 should update to version 0.50.1 or later to mitigate the use-after-free vulnerability in the TLS-enabled WebSocket client.

Recommended defensive actions

• Update cpp-httplib to version 0.50.1 or later
• Review and verify the version of cpp-httplib in use
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide evidence of a use-after-free vulnerability in cpp-httplib versions 0.33.0 through 0.50.0. The vulnerability is triggered when the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it. The issue is fixed in version 0.50.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.