CVE-2026-32627: cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and setfollowlocation(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability CVE-2026-32627?
CVE-2026-32627 is a vulnerability in cpp-httplib that allows a silent TLS certificate verification bypass during HTTPS redirects when using a proxy.
What is the severity of CVE-2026-32627?
CVE-2026-32627 is considered a high severity vulnerability due to potential exposure of sensitive data.
How do I fix CVE-2026-32627?
To fix CVE-2026-32627, update cpp-httplib to version 0.37.2 or later.
What versions of cpp-httplib are affected by CVE-2026-32627?
CVE-2026-32627 affects all versions of cpp-httplib prior to 0.37.2.
How can CVE-2026-32627 impact my application?
CVE-2026-32627 can lead to man-in-the-middle attacks, where attackers can intercept and manipulate HTTPS traffic.