{"id":"CVE-2026-77358","summary":"cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()","details":"cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1.","aliases":["GHSA-w7p7-f35j-mw7q"],"modified":"2026-10-28T11:17:52.309066673Z","published":"2026-08-27T22:37:14.339Z","related":["openSUSE-SU-2026:11979-1"],"database_specific":{"cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77358.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77358.json"},{"type":"ADVISORY","url":"https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-w7p7-f35j-mw7q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77358"},{"type":"FIX","url":"https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yhirose/cpp-httplib","events":[{"introduced":"f1f8ff53d53096946a97416525a1079dd9e8a5b1"},{"fixed":"ed97a6edbabb096fc0a7fb2c63599475b94b81a8"},{"fixed":"2f986fd5e56e7c5f686d965174516360930f371d"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0.33.0"},{"fixed":"0.50."}]},{"range":[{"fixed":"2f986fd5e56e7c5f686d965174516360930f371d"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v0.49.0","v0.48.0","v0.47.0","v0.46.1","v0.46.0","v0.45.1","v0.45.0","v0.44.0","v0.43.4","v0.43.3","v0.43.2","v0.43.1","v0.43.0","v0.42.0","v0.41.0","v0.40.0","v0.39.0","v0.38.0","v0.37.2","v0.37.1","v0.37.0","v0.35.0","v0.34.0","latest","v0.33.1","v0.33.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77358.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["297287838952305863275298420103638592478","247023360116452330326243774984185212616","28804401409393754724253056287864689539","101468530805852710030276723938626781709","192268564893327712083248144341363119453","271933432445333206133397153910859414277","225054966004429426215781624771772498724","234034043540103597816003749983106736713","301716845961039185832839040174326590819"],"threshold":0.9},"id":"CVE-2026-77358-3bc88f6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d","target":{"file":"httplib.h"}},{"source":"https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d","target":{"file":"httplib.h","function":"WebSocketClient::shutdown_and_close"},"deprecated":false,"digest":{"function_hash":"329484782945532097179392272936682716502","length":453},"id":"CVE-2026-77358-49dd1592","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d","target":{"file":"test/test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71886204046956130600839086318646952302","97733290094102641007109893840914107151","101635897408478727044031561330436963837","141229651883698165240493522206897449863"]},"id":"CVE-2026-77358-c430e5eb","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-28T11:17:52Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}