CVE-2026-32627

CVE-2026-32627 is a high-severity vulnerability in Yhirose Cpp-httplib with a CVSS 3.x base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-295.

Key facts

Description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.

Frequently asked questions

What is CVE-2026-32627?
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.
How severe is CVE-2026-32627?
CVE-2026-32627 has a CVSS 3.x base score of 8.7, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-32627 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-32627?
CVE-2026-32627 affects Yhirose Cpp-httplib. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-32627?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-32627 have an EU (EUVD) identifier?
Yes. CVE-2026-32627 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12137.
When was CVE-2026-32627 published?
CVE-2026-32627 was published on 2026-03-16 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Yhirose Cpp-httplib

All CVEs affecting Yhirose Cpp-httplib →

Other CWE-295 (Improper Certificate Validation) vulnerabilities

Browse all CWE-295 (Improper Certificate Validation) vulnerabilities →