CVE-2026-102944

Deferred Deferred - Pending Action

cpp-httplib Cookie Exposure via Cross-Origin Redirect

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102944

EUVD

EUVD-2026-101592

Affected Vendors & Products

Vendor	Product	Version / Range
yhirose	cpp-httplib	< 0.51.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability in cpp-httplib (versions up to 0.50.0) involves improper handling of Cookie headers during cross-origin HTTP redirects. When following a 301, 302, 307, or 308 redirect, the library removes Host, Proxy-Authorization, and Authorization headers but fails to strip Cookie headers. This allows session cookies to be forwarded to the redirect target, potentially exposing them to an attacker-controlled server.

Detection Guidance

To detect this vulnerability, inspect network traffic for cross-origin redirects (HTTP 301, 302, 307, 308) where Cookie headers are forwarded to a different host. Check if your application uses cpp-httplib versions prior to 0.51.0. Monitor logs for unexpected cookie transmissions during redirects.

Impact Analysis

An attacker who controls a redirect response or has a network position for a non-HTTPS origin could receive session cookies intended for the original origin. This could lead to session hijacking, unauthorized access to user accounts, or data breaches. The impact is high as it compromises confidentiality of sensitive session data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade cpp-httplib to version 0.51.0 or later to address the issue. If upgrading is not possible, implement network-level controls to block or inspect cross-origin redirects. Ensure sensitive headers like Cookies are stripped during redirects in custom code.

Hi! I’m here to help you understand CVE-2026-102944. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70