CVE-2026-102944— cpp-httplib: Cookie header leaked on cross-origin redirect
Quick assessment
Affected
yhirose cpp-httplib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
cpp-httplib 是一个仅包含头文件的 C++ HTTP/HTTPS 库。在 0.51.0 版本之前，当客户端跟随跨域的 301、302、307 或 308 重定向时， 会移除 Host、Proxy-Authorization 和 Authorization 头信息，但不会移除 Cookie 头信息。由于 会复制这些重定向状态码对应的请求，因此通过直接提供或 设置的 cookies 会被发送到重定向目标地址。攻击者若能够控制重定向响应，或在非 HTTPS 源站的网络位置截获流量，便可获取原本应发送给原始源站的
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| yhirose | cpp-httplib | < 0.51.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102944
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
cpp-httplib: Cookie header leaked on cross-origin redirect
Source: CVE Program / CVE List V5
Vulnerability Description
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yhirose | cpp-httplib | < 0.51.0 | - |
|
II. Public POCs for CVE-2026-102944
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102944
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-102944 (1)
Other References for CVE-2026-102944 (2)
-
Release v0.51.0 · yhirose/cpp-httplib · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: cpp-httplib
-
CVE-2026-103930
cpp-httplib open_stream serializes CRLF in request target in -
CVE-2026-77358
cpp-httplib: Use-after-free of TLS session in WebSocketClien -
CVE-2026-77341
cpp-httplib: CRLF injection via unvalidated HTTP trailer hea -
CVE-2026-54919
cpp-httplib: TLS certificate chain verification bypassed for -
CVE-2026-45372
cpp-httplib: HTTP header value percent-decoding in server-si
Same vendor: yhirose
-
CVE-2026-103930
cpp-httplib open_stream serializes CRLF in request target in -
CVE-2026-77358
cpp-httplib: Use-after-free of TLS session in WebSocketClien -
CVE-2026-77341
cpp-httplib: CRLF injection via unvalidated HTTP trailer hea -
CVE-2026-54919
cpp-httplib: TLS certificate chain verification bypassed for -
CVE-2026-45372
cpp-httplib: HTTP header value percent-decoding in server-si
Same weakness: CWE-522
-
CVE-2026-104617
sdbootutil: qrencode invocation leaks PIN/recovery key in /p -
CVE-2026-63160
Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token -
CVE-2026-109953
FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure -
CVE-2026-108904
pH7Builder before 18.5.0 Sensitive Data Exposure via Member -
CVE-2026-39460
Red Lion Controls N-Tron 700 Series Insufficiently Protected
V. Comments for CVE-2026-102944
No comments yet