{"id":"CVE-2026-102944","title":"cpp-httplib is a C++ header-only HTTP/HTTPS library","summary":"cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie he…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-522"],"vendor":"yhirose","product":"cpp-httplib","affected":["cpp-httplib < 0.51.0"],"published":"2026-10-14","updated":"2026-10-15","sourceUpdated":"2026-10-15T15:17:20.150","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102944","references":[{"url":"https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585","label":"security-advisories@github.com"},{"url":"https://github.com/yhirose/cpp-httplib/releases/tag/v0.51.0","label":"security-advisories@github.com"},{"url":"https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv","label":"security-advisories@github.com"},{"url":"https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102944.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-102944"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102944"}],"tags":["nvd","cve.org","csaf","vex","red-hat","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-15T14:40:31.550021Z"},"ingestedAt":"2026-10-14T19:49:57.605Z","slug":"CVE-2026-102944","body":"## Overview\n\ncpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102944.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222405,"id":"CVE-2026-102944","ts":1792077089356,"field":"exploit_available","old":"false","new":"true"}]}