PT-2026-82796
CVE-2026-77358
·
تاريخ النشر
2026-08-27
·
تاريخ التحديث
2026-10-04
الوصف من
CVSS 4.0
8.2
عاليةالمقاييسAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
cpp-httplib versions 0.33.0 through 0.50.0
Description
The TLS-enabled WebSocket client contains a use-after-free flaw. In the
shutdown and close() function, the SSL object is freed and its pointer is cleared; however, the subsequent WebSocket close process attempts to send a close frame through the SSL socket stream. Because the stream retains a raw copy of the now-dangling session pointer, it reads from and writes to the freed memory. This condition is also reachable via the client's destructor and its connect path, meaning a standard teardown of a secure WebSocket connection can trigger the issue.Recommendations
Update to version 0.50.1.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾