CVE-2026-77358

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77358.json"
}

References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type

GIT

Repo

https://github.com/yhirose/cpp-httplib

Events

Introduced

f1f8ff53d53096946a97416525a1079dd9e8a5b1

Fixed

ed97a6edbabb096fc0a7fb2c63599475b94b81a8

Fixed

2f986fd5e56e7c5f686d965174516360930f371d

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.33.0"
                },
                {
                    "fixed":  "0.50."
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "2f986fd5e56e7c5f686d965174516360930f371d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other

latest

v0.*

v0.33.0

v0.33.1

v0.34.0

v0.35.0

v0.37.0

v0.37.1

v0.37.2

v0.38.0

v0.39.0

v0.40.0

v0.41.0

v0.42.0

v0.43.0

v0.43.1

v0.43.2

v0.43.3

v0.43.4

v0.44.0

v0.45.0

v0.45.1

v0.46.0

v0.46.1

v0.47.0

v0.48.0

v0.49.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77358.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "297287838952305863275298420103638592478",
                "247023360116452330326243774984185212616",
                "28804401409393754724253056287864689539",
                "101468530805852710030276723938626781709",
                "192268564893327712083248144341363119453",
                "271933432445333206133397153910859414277",
                "225054966004429426215781624771772498724",
                "234034043540103597816003749983106736713",
                "301716845961039185832839040174326590819"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-77358-3bc88f6c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d",
        "target":  {
            "file":  "httplib.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "329484782945532097179392272936682716502",
            "length":  453
        },
        "id":  "CVE-2026-77358-49dd1592",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d",
        "target":  {
            "file":  "httplib.h",
            "function":  "WebSocketClient::shutdown_and_close"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "71886204046956130600839086318646952302",
                "97733290094102641007109893840914107151",
                "101635897408478727044031561330436963837",
                "141229651883698165240493522206897449863"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-77358-c430e5eb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d",
        "target":  {
            "file":  "test/test.cc"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:17:52Z"