Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
[CVE-2026-32627: HIGH] Vulnerability alert: Prior to cpp-httplib 0.37.2, HTTPS redirect can disable TLS certificate verification. Update to 0.37.2 to fix the security issue.#cve,CVE-2026-32627,#cybersecurity https://cvefind.com/CVE-2026-32627
Post summary
An issue in cpp-httplib before version 0.37.2 allows HTTPS redirects to disable TLS certificate verification. Users are advised to upgrade to 0.37.2 to remediate the problem.
CVE-2026-32627 cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow… https://www.cve.org/CVERecord?id=CVE-2026-32627
Post summary
CVE-2026-32627 is a vulnerability in cpp-httplib that exists in versions before 0.37.2, and updating to 0.37.2 or later resolves the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | yhirose | cpp-httplib | - | - | - |