CVE-2026-102944

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-102944

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102944.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-102944

Aliases

GHSA-22mf-w2v3-r2jv

Published

2026-10-14T18:18:21Z

Modified

2026-10-16T07:07:53Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

cpp-httplib: Cookie header leaked on cross-origin redirect

Details

cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-522"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102944.json"
}

References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type

GIT

Repo

https://github.com/yhirose/cpp-httplib

Events

Introduced

Fixed

0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585

Fixed

d66d9a95997d51a8ba9822a611d1267757741535

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.51.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other

latest

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.8

v0.10.9

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.18.5

v0.18.6

v0.18.7

v0.19.0

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.20.0

v0.20.1

v0.21.0

v0.22.0

v0.23.0

v0.23.1

v0.24.0

v0.25.0

v0.26.0

v0.27.0

v0.28.0

v0.29.0

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.30.0

v0.30.1

v0.30.2

v0.31.0

v0.32.0

v0.33.0

v0.33.1

v0.34.0

v0.35.0

v0.37.0

v0.37.1

v0.37.2

v0.38.0

v0.39.0

v0.4.0

v0.4.1

v0.4.2

v0.40.0

v0.41.0

v0.42.0

v0.43.0

v0.43.1

v0.43.2

v0.43.3

v0.43.4

v0.44.0

v0.45.0

v0.45.1

v0.46.0

v0.46.1

v0.47.0

v0.48.0

v0.49.0

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.13

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.50.0

v0.50.1

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.10

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102944.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "158978366591480317483311759578189411696",
            "length":  1436
        },
        "id":  "CVE-2026-102944-4f55ba7e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585",
        "target":  {
            "file":  "httplib.h",
            "function":  "ClientImpl::create_redirect_client"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "267773344545165521421771345405646178505",
                "29453404087165895867028960871641504800",
                "9163449636043926260013405780676487221"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-102944-b1d8dae5",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585",
        "target":  {
            "file":  "test/test.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "83597438551692461233755986540604842440",
                "63348776602853957190304769076966890588",
                "186614463205869691452466185361475881249",
                "887992791117469747503947117977419328",
                "254236241194187803768142353551735392933"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-102944-df652b2a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585",
        "target":  {
            "file":  "httplib.h"
        }
    }
]

vanir_signatures_modified

"2026-10-16T07:07:53Z"