# CVE-2026-102944: cpp-httplib cookie exposure in cross-origin redirect

Source: https://junglewise.ai/threats/cve-2026-102944-cpp-httplib-is-a-c-header-only-http-https-library-prior-to-0-51  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-102944 · Severity: high · CVSS 7.5 · Published 2026-10-14

cpp-httplib is a C++ HTTP/HTTPS client library used in applications to make web requests. When following redirects (301, 302, 307, 308) to a different website, the library fails to strip session cookies before sending the request, allowing an attacker who controls a redirect or network position to steal session tokens intended for the original site.

Technologies: [Yhirose Cpp-Httplib](https://junglewise.ai/threats/technologies/cpp-httplib). Vendors: [Yhirose](https://junglewise.ai/threats/vendors/yhirose).

## Quick answers

**Is CVE-2026-102944 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102944 being exploited in the wild.

**How severe is CVE-2026-102944?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Yhirose Cpp-Httplib prior to 0.51.0.

**Is there a fix for CVE-2026-102944?** Yes: fixed in 0.51.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102944 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102944?** Check whether you run Yhirose Cpp-Httplib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.51.0

## Technical details

The create_redirect_client() method removes Host, Proxy-Authorization, and Authorization headers on cross-origin redirects but leaves Cookie and Cookie2 headers attached. An attacker controlling a redirect response or network position for non-HTTPS origins can intercept these cookies. The vulnerability affects versions prior to 0.51.0; a fix was applied to strip Cookie/Cookie2 headers alongside the other sensitive headers.

## Affected products

- yhirose cpp-httplib prior to 0.51.0

## Timeline

- 2026-10-14: disclosed

## References

- [https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585](https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585)
- [https://github.com/yhirose/cpp-httplib/releases/tag/v0.51.0](https://github.com/yhirose/cpp-httplib/releases/tag/v0.51.0)

## Related threats

- [cpp-httplib use-after-free in TLS WebSocket client](https://junglewise.ai/threats/cve-2026-77358-cpp-httplib-use-after-free-in-tls-websocket-client)
- [cpp-httplib CRLF injection in chunked response trailers](https://junglewise.ai/threats/cve-2026-77341-cpp-httplib-crlf-injection-in-chunked-response-trailers)
- [yhirose cpp-httplib denial of service via malformed X-Forwarded-For header](https://junglewise.ai/threats/cve-2026-46527-yhirose-cpp-httplib-denial-of-service-via-malformed-x-forwarded)
- [yhirose cpp-httplib CRLF injection in parse_header](https://junglewise.ai/threats/cve-2026-45372-yhirose-cpp-httplib-crlf-injection-in-parse-header)
- [yhirose cpp-httplib denial of service via negative chunk-size](https://junglewise.ai/threats/cve-2026-45352-yhirose-cpp-httplib-denial-of-service-via-negative-chunk-size)