DEBIAN-CVE-2026-32627

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-32627
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32627.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-32627
Upstream
Published
2026-03-16T14:19:40Z
Modified
2026-09-14T17:03:27Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.

References

Affected packages

Debian:12 / cpp-httplib

Package

Name
cpp-httplib
Purl
pkg:deb/debian/cpp-httplib?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.11.4+ds-1
0.11.4+ds-1+deb12u1
0.11.4+ds-2
0.11.4+ds-3
0.13.1+ds-1
0.14.0+ds-1
0.14.1+ds-1
0.14.1+ds-2
0.14.2+ds-1
0.14.3+ds-1
0.14.3+ds-1.1~exp1
0.14.3+ds-1.1
0.15.3+ds-1
0.15.3+ds-2
0.15.3+ds-3
0.16.0+ds-1
0.16.3+ds-1
0.16.3+ds-2
0.18.0+ds-1
0.18.7-1
0.20.1+ds-3
0.25.0+ds-1
0.26.0+ds-2
0.41.0+ds-1
0.41.0+ds-2
0.41.0+ds-3~bpo13+1
0.41.0+ds-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32627.json"

Debian:13 / cpp-httplib

Package

Name
cpp-httplib
Purl
pkg:deb/debian/cpp-httplib?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.18.7-1
0.18.7-1+deb13u1
0.20.1+ds-3
0.25.0+ds-1
0.26.0+ds-2
0.41.0+ds-1
0.41.0+ds-2
0.41.0+ds-3~bpo13+1
0.41.0+ds-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32627.json"

Debian:14 / cpp-httplib

Package

Name
cpp-httplib
Purl
pkg:deb/debian/cpp-httplib?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.41.0+ds-3

Affected versions

0.*
0.18.7-1
0.20.1+ds-3
0.25.0+ds-1
0.26.0+ds-2
0.41.0+ds-1
0.41.0+ds-2
0.41.0+ds-3~bpo13+1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32627.json"