CVE-2026-28434: falha de média gravidade em yhirose cpp-httplib
cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
yhirose · cpp-httplibCVEs relacionadas — yhirose cpp-httplib
No mesmo produto, das mais perigosas para as menos.
CVE-2026-29076MEDIUMcpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsingEPSS 0.7%CVE-2025-46728HIGHcpp-httplib has Unbounded Memory Allocation in Chunked/No-Length RequestsEPSS 0.7%CVE-2025-53629HIGHcpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests VulnerabilityEPSS 0.6%CVE-2025-53628MEDIUMcpp-httplib does not limit the length of a lineEPSS 0.5%CVE-2026-31870HIGHcpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response HeaderEPSS 0.5%CVE-2025-52887HIGHcpp-httplib has unlimited number of http header fields, which causes memory leakEPSS 0.5%