CVE-2026-28434: Cpp-httplib Information Disclosure Flaw

CVE-2026-28434 Overview

CVE-2026-28434 is an Information Disclosure vulnerability affecting cpp-httplib, a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to any client making a request, with no authentication check and no special configuration required to trigger it.

The behavior is enabled by default, meaning developers who are unaware of the need to opt in to set_exception_handler() will inadvertently ship servers that leak internal exception messages to any client. This vulnerability has been fixed in version 0.35.0.

Critical Impact
Internal exception messages containing sensitive application details, stack traces, file paths, or configuration information may be exposed to unauthenticated remote attackers via the EXCEPTION_WHAT HTTP response header.

Affected Products

yhirose cpp-httplib versions prior to 0.35.0

Discovery Timeline

2026-03-04 - CVE CVE-2026-28434 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28434

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue stems from cpp-httplib's default exception handling behavior, which prioritizes developer convenience over security by automatically serializing exception messages into HTTP response headers.

When a request handler in an application built with cpp-httplib throws an unhandled C++ exception, the library's internal exception handling mechanism intercepts it. Rather than returning a generic error response, the library extracts the exception's what() message and includes it verbatim in a custom HTTP header called EXCEPTION_WHAT. This design decision creates an information disclosure channel that operates without any access controls.

The impact extends beyond simple error messages. C++ exceptions can contain detailed diagnostic information including internal function names, memory addresses, database connection strings, file system paths, configuration details, and other sensitive application internals. An attacker can deliberately craft requests designed to trigger exceptions, systematically harvesting internal application details that could facilitate further attacks.

Root Cause

The root cause is an insecure default configuration in the exception handling mechanism. The library's default behavior assumes that exposing exception details is acceptable, placing the burden on developers to explicitly opt out by registering a custom exception handler via set_exception_handler(). This violates the principle of secure defaults, as most developers would not expect internal exception messages to be transmitted to remote clients.

Attack Vector

The attack vector is network-based and requires no authentication or special privileges. An attacker can exploit this vulnerability by sending crafted HTTP requests to any server built with a vulnerable version of cpp-httplib that does not have a custom exception handler configured.

The attack methodology involves:

Identifying a target server using cpp-httplib (potentially through response headers or error behaviors)
Sending malformed or edge-case requests designed to trigger exception conditions in request handlers
Examining the EXCEPTION_WHAT header in HTTP responses to extract leaked information
Using gathered information (file paths, internal function names, database details) to plan further attacks

This vulnerability requires no user interaction and can be exploited remotely over the network. The information disclosed could include sensitive internal application details that would otherwise be inaccessible to external parties.

Detection Methods for CVE-2026-28434

Indicators of Compromise

Presence of EXCEPTION_WHAT headers in outbound HTTP responses from servers using cpp-httplib
Unusual patterns of malformed or deliberately invalid requests targeting application endpoints
Network traffic containing HTTP responses with detailed C++ exception messages or stack trace information
Evidence of reconnaissance activity probing for error conditions in web services

Detection Strategies

Implement egress monitoring to detect HTTP responses containing the EXCEPTION_WHAT header
Review application logs for patterns of requests that consistently trigger exception conditions
Perform code audits to identify cpp-httplib usage without explicit set_exception_handler() registration
Deploy web application firewalls (WAF) with rules to sanitize or block responses containing sensitive exception details

Monitoring Recommendations

Configure network monitoring tools to alert on HTTP responses containing the EXCEPTION_WHAT header pattern
Establish baseline metrics for exception rates and investigate sudden increases in error responses
Implement logging for all unhandled exceptions at the application level before they reach the library's default handler

How to Mitigate CVE-2026-28434

Immediate Actions Required

Upgrade cpp-httplib to version 0.35.0 or later immediately
If immediate upgrade is not possible, implement a custom exception handler using set_exception_handler() that does not expose exception details
Audit all applications using cpp-httplib to ensure custom exception handlers are properly configured
Review web server logs for evidence of EXCEPTION_WHAT header exposure to identify potential prior information disclosure

Patch Information

The vulnerability is fixed in cpp-httplib version 0.35.0. The fix modifies the default exception handling behavior to prevent automatic exposure of exception messages in HTTP response headers. Details of the patch can be reviewed in the GitHub Commit Review. Additional context is available in the GitHub Security Advisory GHSA-8mpw-r4gc-xm7q.

Workarounds

Register a custom exception handler using set_exception_handler() that returns a generic error response without exposing internal exception details
Implement a reverse proxy or WAF in front of vulnerable applications to strip EXCEPTION_WHAT headers from responses
Add application-level exception handling in all request handlers to prevent exceptions from propagating to the library's default handler
Consider network segmentation to limit exposure of vulnerable services to untrusted networks until patching is complete

bash

# Verify cpp-httplib version in your project
grep -r "cpp-httplib" . --include="*.h" --include="*.hpp" | head -20
# Check for set_exception_handler usage
grep -r "set_exception_handler" . --include="*.cpp" --include="*.h"