CVE-2026-102944

7.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-522

Impact

Attackers controlling a redirect target or network path can steal sensitive session cookies intended for the original host. They need to induce the client to follow a cross-origin 301, 302, 307, or 308 redirect.

Root cause

The client strips Host and Authorization headers during cross-origin redirects but fails to strip Cookie headers when copying the request.

Affected systems

cpp-httplib versions prior to 0.51.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade cpp-httplib to version 0.51.0 or newer. If you cannot upgrade immediately, disable automatic redirect following or manually sanitize Cookie headers before handling cross-origin redirect responses.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102944