CVE-2026-77358

Name of the Vulnerable Software and Affected Versions cpp-httplib versions 0.33.0 through 0.50.0

Description The TLS-enabled WebSocket client contains a use-after-free flaw. In the shutdown and close() function, the SSL object is freed and its pointer is cleared; however, the subsequent WebSocket close process attempts to send a close frame through the SSL socket stream. Because the stream retains a raw copy of the now-dangling session pointer, it reads from and writes to the freed memory. This condition is also reachable via the client's destructor and its connect path, meaning a standard teardown of a secure WebSocket connection can trigger the issue.

Recommendations Update to version 0.50.1.