CVE-2026-28434

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via setexceptionhandler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTIONWHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to setexception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28434.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type

GIT

Repo

https://github.com/yhirose/cpp-httplib

Events

Introduced

Fixed

85b18a9c6431877188a706ba3c61679fa9de3e27

Fixed

defd907c7469c5c8281247b73bbd07be24c31164

Database specific

{
    "cpe": "cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.35.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other

latest

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.8

v0.10.9

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.18.5

v0.18.6

v0.18.7

v0.19.0

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.20.0

v0.20.1

v0.21.0

v0.22.0

v0.23.0

v0.23.1

v0.24.0

v0.25.0

v0.26.0

v0.27.0

v0.28.0

v0.29.0

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.30.0

v0.30.1

v0.30.2

v0.31.0

v0.32.0

v0.33.0

v0.33.1

v0.34.0

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.13

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.10

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "source": "https://github.com/yhirose/cpp-httplib/commit/defd907c7469c5c8281247b73bbd07be24c31164",
        "deprecated": false,
        "target": {
            "file": "test/test.cc",
            "function": "TEST"
        },
        "id": "CVE-2026-28434-740ddf0b",
        "signature_type": "Function",
        "digest": {
            "length": 1110.0,
            "function_hash": "41981864488302345516269030424064580205"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/yhirose/cpp-httplib/commit/defd907c7469c5c8281247b73bbd07be24c31164",
        "deprecated": false,
        "target": {
            "file": "test/test.cc"
        },
        "id": "CVE-2026-28434-81aa0a91",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "63834713402081273745810446471330530818",
                "320973646099220254356823073518041107229",
                "303210860184062865642528091428604590870",
                "227124770872562923734926808359795145361",
                "42618641562022343643708473212364417393",
                "324469289996381865990253720209702263864",
                "266908419659980811739644440341267042607",
                "214962231421048053571724316461567911438",
                "1077878293302846807829949323612166819",
                "158626294247159555335328449112207248791",
                "261195042394169660240527045813467673536",
                "193101090654266125838864761285301104129"
            ]
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/yhirose/cpp-httplib/commit/defd907c7469c5c8281247b73bbd07be24c31164",
        "deprecated": false,
        "target": {
            "file": "httplib.h"
        },
        "id": "CVE-2026-28434-e2707fa0",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "90755225098798093721445384230847044191",
                "187737594691015317109250698263582711031",
                "115788921515734923355853485287421059534",
                "180723636644975966282693183718812814976",
                "175092947288160594054231419692181363131",
                "19796841147996503122528289807420164670",
                "267522838301682070816590055807701518554",
                "200223472509420237347556805150636504647",
                "184036184309615679403939277790043585576",
                "110821323413963403984926990718927521573",
                "142028123286143523236472557411291744235",
                "255271312488025494934055413407486307294",
                "279542636305437116269651307444288099207",
                "35279993915048769953558228390435713156",
                "97327610048995590293687551217030093662",
                "15763517233982024065383976258657288523",
                "104939692126895657446621468718863441427"
            ]
        }
    }
]

vanir_signatures_modified

"2026-07-22T03:08:50Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28434.json"