CVE-2026-77358: cpp-httplib Use-After-Free Vulnerability

CVE-2026-77358 Overview

CVE-2026-77358 is a use-after-free vulnerability [CWE-416] in cpp-httplib, a widely used C++ header-only HTTP/HTTPS library. The flaw affects versions 0.33.0 through 0.50.0 and resides in the TLS-enabled WebSocket client. The WebSocketClient::shutdown_and_close routine frees the SSL session before the WebSocket close frame is sent. The close frame is then transmitted through an SSLSocketStream that still holds a raw pointer to the freed session, resulting in reads from and writes to freed memory. The defect is reached through ordinary teardown paths, including the client's destructor and its connect path.

Critical Impact
Any secure WebSocket client teardown triggers memory corruption in the TLS session, exposing applications to denial of service and potential memory disclosure.

Affected Products

cpp-httplib versions 0.33.0 through 0.50.0
Applications embedding the header-only library with CPPHTTPLIB_SSL_ENABLED and WebSocket client usage
Fixed in cpp-httplib version 0.50.1

Discovery Timeline

2026-08-28 - CVE-2026-77358 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-77358

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the WebSocket teardown sequence of cpp-httplib. When TLS is enabled, WebSocketClient owns both a ws_ object wrapping an SSLSocketStream and a tls_session_ handle. The SSLSocketStream retains a raw pointer to tls_session_. During shutdown_and_close, the SSL object is freed and the pointer is cleared before the WebSocket close frame is dispatched. The close operation then invokes the stream's read and write functions against the dangling session pointer.

Root Cause

The root cause is incorrect object lifetime ordering. The TLS session is released before the ws_ object that depends on it. Because SSLSocketStream stores a raw, non-owning pointer to the session rather than a reference-counted handle, the stream cannot observe the destruction. Both the destructor and the connect error-recovery path reach the same freed-then-used ordering.

Attack Vector

Exploitation does not require authentication or user interaction. A remote server that a vulnerable client connects to over wss:// can influence the timing and content of the WebSocket close sequence. Any teardown of a secure WebSocket connection triggers the defect, so a network-adjacent attacker who controls or influences the remote endpoint can reliably reach the freed memory access. Impact is primarily availability (process crash) with potential for memory disclosure depending on allocator state.

 inline bool WebSocketClient::is_valid() const { return is_valid_; }
 
 inline void WebSocketClient::shutdown_and_close() {
+  // Send the close frame while the TLS session is still alive: ws_ holds an
+  // SSLSocketStream that keeps a raw pointer to tls_session_, so the session
+  // must outlive ws_->close() and ws_.reset() to avoid a use-after-free.
+  if (ws_ && ws_->is_open()) { ws_->close(); }
+  ws_.reset();
 #ifdef CPPHTTPLIB_SSL_ENABLED
   if (is_ssl_) {
     if (tls_session_) {

Source: GitHub Commit 2f986fd5. The patch reorders teardown to send the close frame and reset ws_ before the TLS session is released.

Detection Methods for CVE-2026-77358

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes linking cpp-httplib following wss:// disconnects.
AddressSanitizer or Valgrind reports flagging heap-use-after-free in SSLSocketStream::read or SSLSocketStream::write during WebSocket close.
Core dumps referencing WebSocketClient::shutdown_and_close or the client destructor frames.

Detection Strategies

Inventory C++ binaries and containers for embedded cpp-httplib versions in the range 0.33.0 to 0.50.0 using software composition analysis.
Build affected services with AddressSanitizer in test environments and exercise WebSocket connect and close paths.
Monitor application logs and crash telemetry for repeated abnormal exits on services that maintain outbound wss:// sessions.

Monitoring Recommendations

Forward crash reports and process exit telemetry to a centralized analytics pipeline for anomaly detection.
Track outbound wss:// destinations from services using cpp-httplib and alert on connections to unexpected hosts.
Correlate crash events with network sessions to identify servers that consistently trigger client-side faults.

How to Mitigate CVE-2026-77358

Immediate Actions Required

Upgrade all embedded copies of cpp-httplib to version 0.50.1 and rebuild dependent binaries.
Audit build systems, container images, and vendored dependencies for the header file httplib.h at vulnerable versions.
Restrict outbound wss:// connections from affected services to trusted destinations until patched.

Patch Information

The issue is fixed in cpp-httplib 0.50.1. The corrective commit is 2f986fd5, which sends the WebSocket close frame and resets ws_ before freeing the TLS session. Full details are available in the GitHub Security Advisory GHSA-w7p7-f35j-mw7q.

Workarounds

Disable the TLS WebSocket client path in applications that can operate without wss:// until the library is upgraded.
Avoid programmatic teardown of WebSocketClient instances in long-lived processes; recycle processes instead where feasible.
Restrict client connections to internal, trusted WebSocket endpoints to reduce exposure to adversary-controlled servers.

bash

# Verify installed cpp-httplib version and update
grep -R "CPPHTTPLIB_VERSION" /path/to/vendor/httplib.h
# Replace vendored header with the patched release
curl -L -o httplib.h \
  https://raw.githubusercontent.com/yhirose/cpp-httplib/v0.50.1/httplib.h