CVE-2026-28434: cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via setexceptionhandler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTIONWHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to setexceptionhandler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28434?
CVE-2026-28434 is considered a medium severity vulnerability due to the potential leakage of error information to clients.
How do I fix CVE-2026-28434?
To fix CVE-2026-28434, upgrade cpp-httplib to version 0.35.0 or later where the vulnerability is resolved.
What are the risks associated with CVE-2026-28434?
The risks associated with CVE-2026-28434 include the potential exposure of sensitive error messages in the EXCEPTION_WHAT response header.
Which versions of cpp-httplib are affected by CVE-2026-28434?
CVE-2026-28434 affects all versions of cpp-httplib prior to 0.35.0.
Is CVE-2026-28434 a remote code execution vulnerability?
No, CVE-2026-28434 is not a remote code execution vulnerability, but it does involve information leakage.