CVE-2026-54919

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT and a client connects to an IP-literal host with server certificate verification enabled, SSLClient and Client in HTTPS mode skip certificate chain validation and WebSocketClient on the Mbed TLS backend skips verification altogether, allowing a man-in-the-middle attacker positioned to intercept traffic to present a crafted certificate and read or modify the traffic. This issue is fixed in version 0.47.0.

• CWE-295

• https://github.com/yhirose/cpp-httplib/commit/fa981cedae004ea9d946f1392b9dec22fac6fee6Patch
• https://github.com/yhirose/cpp-httplib/releases/tag/v0.47.0Product, Release Notes
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8ffh-4p95-g3p2Mitigation, Patch, Vendor Advisory

Published

Jul 10, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54908Pion DTLS is a Go implementation of Datagram Transport Layer…6.3
• CVE-2026-54909pion/stun is a Go implementation of STUN. Prior to 3.1.3, XO…5.3
• CVE-2026-5491DriveLock Directory Traversal Information Disclosure Vulnera…7.5
• CVE-2026-54910FileBrowser Quantum is a free, self-hosted, web-based file m…7.7
• CVE-2026-54911UltraJSON is a fast JSON encoder and decoder written in pure…6.5
• CVE-2026-54917SeaweedFS is a distributed storage system for object storage…10
• CVE-2026-5492DriveLock Directory Traversal Information Disclosure Vulnera…6.5
• CVE-2026-5493Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bou…7.8
• CVE-2026-5494Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bou…7.8
• CVE-2026-5495Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bou…7.8
• CVE-2026-5496Labcenter Electronics Proteus PDSPRJ File Parsing Type Confu…7.8
• CVE-2026-5497vLLM versions 0.8.0 and later are vulnerable to an Out-of-Me…7.5