CVE-2026-54919: cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIBMBEDTLSSUPPORT or CPPHTTPLIBWOLFSSLSUPPORT and a client connects to an IP-literal host with server certificate verification enabled, SSLClient and Client in HTTPS mode skip certificate chain validation and WebSocketClient on the Mbed TLS backend skips verification altogether, allowing a man-in-the-middle attacker positioned to intercept traffic to present a crafted certificate and read or modify the traffic. This issue is fixed in version 0.47.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54919?
The severity of CVE-2026-54919 is rated as high with a score of 7.4.
How do I fix CVE-2026-54919?
To fix CVE-2026-54919, upgrade cpp-httplib to version 0.47.0 or later.
What does CVE-2026-54919 affect?
CVE-2026-54919 affects the cpp-httplib library when built with Mbed TLS or wolfSSL support.
What is the impact of CVE-2026-54919?
CVE-2026-54919 allows a TLS certificate chain verification bypass for IP-literal hosts.
Which versions of Mbed TLS and wolfSSL are vulnerable in CVE-2026-54919?
Affected Mbed TLS versions range from 0.31.0 to 0.46.1 and wolfSSL versions from 0.33.0 to 0.46.1.