CVE-2026-102944: cpp-httplib: Cookie header leaked on cross-origin redirect
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, createredirectclient() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through defaultheaders are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cpp-httplibto a version that resolves this vulnerability.Fixed in 0.51.0
Event History
Frequently Asked Questions
Which applications are exposed to cookie leakage?
Applications using cpp-httplib before 0.51.0 are exposed when they send Cookie headers and follow a cross-origin 301, 302, 307, or 308 redirect. Cookies supplied directly on a request or through default_headers_ can be forwarded to the redirect target.
What must an attacker be able to do to obtain cookies?
An attacker must be able to control a redirect response that sends the client to a different origin. For requests to a non-HTTPS origin, an attacker in a network position can also potentially obtain the cookies.
Are all redirect responses affected?
No. The issue affects cross-origin 301, 302, 307, and 308 redirects; the 303 redirect path clears all request headers and is not affected.
What can be done if upgrading is not immediately possible?
Avoid following cross-origin 301, 302, 307, and 308 redirects on requests that include Cookie headers. In particular, do not place sensitive cookies in request headers or default_headers_ where such redirects may be followed.
How can I determine whether my use is affected?
Check whether the application uses a cpp-httplib version earlier than 0.51.0, sends Cookie headers directly or through default_headers_, and follows cross-origin redirects. Requests redirected with status 301, 302, 307, or 308 are the relevant cases.