CVE-2026-32627: Cpp-httplib Information Disclosure Flaw

CVE-2026-32627 Overview

CVE-2026-32627 is a Certificate Validation Bypass vulnerability in cpp-httplib, a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application.

Critical Impact

A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This enables man-in-the-middle attacks against applications using the vulnerable library.

Affected Products

• yhirose cpp-httplib versions prior to 0.37.2

Discovery Timeline

• March 16, 2026 - CVE-2026-32627 published to NVD
• March 17, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32627

Vulnerability Analysis

This vulnerability (CWE-295: Improper Certificate Validation) arises from a flaw in how cpp-httplib handles HTTPS redirects when operating through a proxy server. The library's redirect-following logic fails to properly initialize TLS verification settings for subsequent connections after a redirect response is received. When a client configured with both a proxy and automatic redirect following receives a 3xx redirect response, the new HTTPS connection established to the redirect target does not inherit or reinitialize the TLS certificate validation settings.

The security implications are severe because the vulnerability operates silently — no errors or warnings are raised to alert the application or user that certificate validation has been bypassed. This creates a false sense of security where developers believe their HTTPS connections are properly secured when they are actually vulnerable to interception.

Root Cause

The root cause lies in the improper initialization of SSL/TLS verification parameters when establishing a new connection following an HTTP redirect. When the library creates a new connection to follow a redirect, the SSL context for the new connection is not properly configured to verify the server's certificate against trusted certificate authorities or to validate the hostname matches the certificate's subject alternative names. This initialization oversight specifically manifests in proxy configurations where the redirect handling code path diverges from the standard direct connection flow.

Attack Vector

The attack vector requires an attacker to be in a network position where they can intercept or manipulate HTTP/HTTPS traffic — such as on the same network segment, controlling a malicious proxy, or through DNS poisoning. The attacker can then return a crafted redirect response pointing to an attacker-controlled server presenting a fraudulent TLS certificate. Since certificate validation is silently disabled on the redirect connection, the client will establish an encrypted tunnel with the attacker's server, transmitting any credentials, session tokens, API keys, or sensitive data intended for the legitimate destination.

The attack is particularly insidious because the connection appears encrypted and secure from the application's perspective — all HTTPS indicators remain intact while the actual security has been completely compromised.

Detection Methods for CVE-2026-32627

Indicators of Compromise

• Unexpected TLS certificate warnings or errors in network monitoring tools when traffic flows through proxies
• Network traffic showing HTTPS connections to unexpected IP addresses after redirect responses
• Application logs indicating redirect chains through suspicious or unexpected domains
• Certificate chain validation failures in enterprise SSL inspection tools

Detection Strategies

• Audit application dependencies for cpp-httplib versions prior to 0.37.2
• Monitor network traffic for proxy-based connections that follow redirects to untrusted hosts
• Deploy network security tools capable of detecting certificate validation anomalies
• Review application code for usage patterns combining proxy configuration with set_follow_location(true)

Monitoring Recommendations

• Implement centralized logging of all TLS certificate validation events in applications using cpp-httplib
• Configure network intrusion detection systems to alert on suspicious redirect patterns
• Enable verbose logging in applications to capture redirect chains and certificate information
• Monitor for anomalous traffic patterns indicative of man-in-the-middle attacks

How to Mitigate CVE-2026-32627

Immediate Actions Required

• Upgrade cpp-httplib to version 0.37.2 or later immediately
• Audit all applications using cpp-httplib with proxy configurations and set_follow_location(true) enabled
• Consider temporarily disabling automatic redirect following until the patch is applied
• Review application configurations to identify exposure to this vulnerability

Patch Information

The vulnerability is fixed in cpp-httplib version 0.37.2. The fix ensures that TLS certificate and hostname verification settings are properly maintained and applied when following HTTPS redirects through a proxy. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-c3h8-fqq4-xm4g.

Workarounds

• Disable automatic redirect following by removing or setting set_follow_location(false) and manually handling redirects with proper certificate validation
• Implement custom redirect handling logic that explicitly validates certificates for each new connection
• Use a different HTTP client library with proper certificate validation until upgrading is possible
• Configure network-level certificate pinning or SSL inspection to detect invalid certificates

# Update cpp-httplib to patched version
# If using vcpkg:
vcpkg upgrade cpp-httplib

# If using git submodule, update to v0.37.2 or later:
cd deps/cpp-httplib
git fetch --tags
git checkout v0.37.2