CVE-2026-28434: cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-04 · updated 2026-06-17
Weakness: CWE-200

Description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.

Affected products

yhirose cpp-httplib: before 0.35.0 — fixed in 0.35.0

How to fix

Upgrade to a fixed version: yhirose cpp-httplib 0.35.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-28434 or the next vulnerability affects your stack