← Vulnerability feed

Vulnerability record · CVE-2026-46527 · published 29 May 2026

CVE-2026-46527: Yhirose cpp-httplib null pointer dereference vulnerability

YYhirose · Cpp Httplib

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.

8.7 CVSS 4.0 High EPSS 0.49% · top 60.6% CWE-476 · NULL pointer dereference
8.7CVSS 4.0 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
22 Jul 2026Last modified by NVD

Description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-hg3g-vrg8-578g ExploitMitigationVendor Advisory
https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-hg3g-vrg8-578g ExploitMitigationVendor Advisory

Track CVE-2026-46527 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-45372Yhirose cpp-httplib http request smuggling vulnerabilitycpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming reque…EPSS 0.41%9.8CVE-2025-66570Yhirose cpp-httplib authentication bypass by spoofing vulnerabilitycpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP he…EPSS 0.33%8.7CVE-2026-22776Yhirose cpp-httplib vulnerabilitycpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability ex…EPSS 0.40%8.1CVE-2026-32627Yhirose cpp-httplib improper certificate validation vulnerabilitycpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a pro…EPSS 0.25%7.7CVE-2026-21428Yhirose cpp-httplib vulnerabilitycpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not ch…EPSS 0.41%7.5CVE-2026-45352Yhirose cpp-httplib improper input validation vulnerabilitycpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding c…EPSS 0.49%7.5CVE-2026-31870Yhirose cpp-httplib vulnerabilitycpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (…EPSS 0.55%7.5CVE-2026-28435Yhirose cpp-httplib uncontrolled resource consumption vulnerabilitycpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::s…EPSS 0.60%

Source: NIST National Vulnerability Database (record CVE-2026-46527), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.