cpp-httplib TLS Certificate Chain Verification Bypass on IP-literal Hosts (CVE-2025-54918)

Vulnerability Overview Title: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends Description: When using with or enabled, and the client connects to a host represented by an IP address (e.g., ), the certificate chain is not verified as being signed by a trusted CA, even if server certificate verification is enabled (which is the default). Impact Scope Affected Versions: - Mbed TLS backend: 0.31.0 - 0.46.1 - wolfSSL backend: 0.33.0 - 0.46.1 Impact: - (HTTPS mode) completely skips certificate chain verification, retaining only the post-handshake IP SAN matching. Any certificate, including self-signed ones, is accepted as long as its SAN entry matches the target IP address. - on the Mbed TLS backend completely skips certificate verification and accepts any server certificate. - A man-in-the-middle (MitM) attacker can intercept traffic and send a forged certificate to the host at the IP address, allowing them to read or modify the traffic. Remediation Fixed Version: 0.47.0 Fix Details: - Chain verification is re-enabled for IP address hosts, and certificate identity is verified against IP SANs during the post-handshake phase. - performs the same post-handshake identity check on all backends. - no longer sends SNI for IP address hosts, complying with RFC 6066. Workarounds If upgrading is not possible: Use the OpenSSL backend. Use DNS hostnames instead of IP addresses for connections. If you must connect to a fixed address, use to bind the hostname to that address, thereby preserving hostname-based certificate verification. References Fix Commit: Fix commit Release Version: Release Additional Information Severity: 7.4 / 10 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None CVE ID: CVE-2025-54918 Weakness: CWE-295

Goal Reached Thanks to every supporter — we hit 100%!

cpp-httplib TLS Certificate Chain Verification Bypass on IP-literal Hosts (CVE-2025-54918)

More from this source