CVE-2026-28434

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.

Affected products

Cpp-Httplib

Yhirose Cpp-httplib

< 0.35.0

Fix

Available

CVSS 3.1

5.3 MEDIUM

EPSS

0.3% (22th percentile)

Weakness

CWE-200

NVD status

Analyzed

Published

2026-03-04

No exploit for CVE-2026-28434 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.