CVE-2026-77358

Deferred Deferred - Pending Action

Use-After-Free in cpp-httplib TLS WebSocket Client

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-77358

Affected Vendors & Products

Vendor	Product	Version / Range
yhirose	cpp-httplib	to 0.50.1 (exc)
yhirose	cpp-httplib	0.50.1
cpp-httplib	cpp-httplib	From 0.33.0 (inc) to 0.50.0 (inc)
cpp-httplib	cpp-httplib	0.50.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the cpp-httplib library affecting versions 0.33.0 through 0.50.0. The issue occurs in the WebSocketClient shutdown process where the TLS session is freed before the WebSocket connection is properly closed. This leaves a dangling pointer that the WebSocket uses when sending a close frame, causing invalid memory access.

Detection Guidance

Detecting this vulnerability requires checking if your system uses cpp-httplib versions 0.33.0 through 0.50.0. Use commands like 'grep -r "cpp-httplib" /path/to/project' or inspect dependency files for the library version. If the version is within the affected range, the system is potentially vulnerable.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code remotely if they can trigger the use-after-free condition during WebSocket teardown or reconnection. It specifically affects applications using the library's TLS-enabled WebSocket client functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a use-after-free flaw in the cpp-httplib library that could lead to remote code execution or crashes, but no evidence suggests it impacts data protection or privacy requirements under these regulations.

Mitigation Strategies

Immediately upgrade cpp-httplib to version 0.50.1 or later. This version fixes the use-after-free issue by reordering operations to ensure the TLS session remains valid until after the WebSocket close frame is sent.

Hi! I’m here to help you understand CVE-2026-77358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70