CVE-2026-46527— cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash
Possible ATT&CK Techniques 2AI
T1499 · Endpoint Denial of Service T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-46527
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash
Source: NVD (National Vulnerability Database)
Vulnerability Description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
空指针解引用
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yhirose | cpp-httplib | < 0.44.0 | - |
II. Public POCs for CVE-2026-46527
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46527
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-46527 (1)
Same Patch Batch · yhirose · 2026-05-29 · 3 CVEs total
| CVE-2026-45372 | 9.9 CRITICAL | cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF |
| CVE-2026-45352 | 5.3 MEDIUM | cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding |
IV. Related Vulnerabilities
Same product: cpp-httplib
- CVE-2026-45372
cpp-httplib: HTTP header value percent-decoding in server-si - CVE-2026-45352
cpp-httplib DoS: Negative chunk-size in chunked Transfer-Enc - CVE-2026-34441
cpp-httplib: HTTP Request Smuggling via Unconsumed GET Reque - CVE-2026-33745
cpp-httplib Client Leaks Authentication Credentials to Untru - CVE-2026-32627
cpp-httplib has a Silent TLS Certificate Verification Bypass
Same vendor: yhirose
- CVE-2026-45372
cpp-httplib: HTTP header value percent-decoding in server-si - CVE-2026-45352
cpp-httplib DoS: Negative chunk-size in chunked Transfer-Enc - CVE-2026-34441
cpp-httplib: HTTP Request Smuggling via Unconsumed GET Reque - CVE-2026-33745
cpp-httplib Client Leaks Authentication Credentials to Untru - CVE-2026-32627
cpp-httplib has a Silent TLS Certificate Verification Bypass
Same weakness: CWE-476
- CVE-2026-45151
NanoMQ: NULL Pointer Dereference - CVE-2026-47337
NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 - CVE-2026-47335
NULL pointer dereference in Ubuntu Linux AppArmor notificati - CVE-2026-47327
NULL pointer dereference in Ubuntu Linux AppArmor notificati - CVE-2026-44710
pam_usb: NULL pointer dereference from UDisks device fields
V. Comments for CVE-2026-46527
No comments yet