« Volver al listado

CVE-2026-32627

Estado: AnalizadaAlta (8.1)—

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Cliente HTTP expuesto a ataque remoto (AV:N, PR:N) por deshabilitación silenciosa de verificación TLS en redirecciones. Permite interceptación de credenciales (T1557, MITM; T1552.004, robo de tokens).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationLimit Access to Resource Over NetworkFilter Network TrafficEncrypt Sensitive InformationVulnerability ScanningUser Training

Tecnologías afectadas (1)

Yhirose — Cpp-httplib

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-32627",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32627",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-16T15:27:59.309320Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "yhirose",
          "product": "cpp-httplib",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.37.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-16T14:19:40.270",
  "references": [
    {
      "url": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2."
    },
    {
      "lang": "es",
      "value": "cpp-httplib es una biblioteca HTTP/HTTPS multiplataforma de C++11 de un solo archivo de cabecera. Antes de 0.37.2, cuando un cliente cpp-httplib está configurado con un proxy y set_follow_location(true), cualquier redirección HTTPS que siga tendrá la verificación de certificado TLS y de nombre de host silenciosamente deshabilitada en la nueva conexión. El cliente aceptará cualquier certificado presentado por el objetivo de redirección — caducado, autofirmado o falsificado — sin generar un error o notificar a la aplicación. Un atacante de red en posición de devolver una respuesta de redirección puede interceptar completamente la conexión HTTPS de seguimiento, incluyendo cualquier credencial o tokens de sesión en tránsito. Esta vulnerabilidad está corregida en 0.37.2."
    }
  ],
  "lastModified": "2026-06-17T10:36:07.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41B98CDE-3EAB-4DFB-9B9C-536C21640B8C",
              "versionEndExcluding": "0.37.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}