CVE-2026-77358

cpp-httplib, a widely used open-source C++ header-only HTTP/HTTPS library, versions 0.33.0 through 0.50.0, contains a use-after-free (CWE-416) in its TLS-enabled WebSocket client. In WebSocketClient::shutdown_and_close the SSL session object is freed before the WebSocket close completes, and the close frame is then sent through the SSL socket stream, which still holds a raw copy of the now-dangling session pointer and reads from and writes to freed memory; the same freed-then-used ordering is also reachable via the client's destructor and its connect path, so ordinary setup or teardown of a secure (WSS) WebSocket connection triggers the defect. An attacker who can cause or time such a connection teardown can corrupt memory and crash the affected application; per the CVSS 4.0 score (8.2 High) the impact is high availability loss with no confidentiality or integrity impact, i.e., remote denial of service. Any application compiled against an affected version and using the library's WebSocket client over TLS is affected, while use that does not involve the TLS WebSocket client is not described as vulnerable in this advisory. No public proof of concept or in-the-wild exploitation is known, EPSS is 0.3% (21st percentile), the issue is not in CISA KEV, and a fix ships in version 0.50.1.

What to do: Upgrade cpp-httplib to 0.50.1 or later, and audit for vendored/bundled copies of the header inside applications rather than relying only on package-manager versions. Until patched, avoid using the library's TLS WebSocket client (i.e., do not make WSS connections with it), since the defect fires on ordinary connection setup and teardown. Prioritize applications that act as secure WebSocket clients toward untrusted endpoints; with no known exploitation and low EPSS, standard patching cycles are reasonable.