| Name | CVE-2026-102944 |
| Description | cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 11512034 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| cpp-httplib (PTS) | bookworm | 0.11.4+ds-1+deb12u1 | vulnerable |
| trixie (security), trixie | 0.18.7-1+deb13u1 | vulnerable | |
| forky, sid | 0.41.0+ds-3 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| cpp-httplib | source | (unstable) | (unfixed) | 11512034 |
https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv
Fixed by: https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585 (v0.51.0)