CVE-2026-77358: CWE-416: Use After Free in yhirose cpp-httplib

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client improperly frees the TLS session before closing the WebSocket, which still uses the session. Specifically, in WebSocketClient::shutdown_and_close, the SSL object is freed and its pointer cleared, but the subsequent WebSocket close sends a close frame through the SSL socket stream that holds a raw pointer to the now-freed session. This results in a use-after-free condition. The same issue can be triggered via the client's destructor and connection path, meaning normal teardown of a secure WebSocket connection triggers the defect. The issue is resolved in version 0.50.1.

Exploitation of this use-after-free vulnerability could lead to memory corruption, potentially causing application crashes or undefined behavior. The CVSS 4.0 score of 8.2 indicates high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability. There is no indication of known exploits in the wild at this time.

A fix is available in cpp-httplib version 0.50.1. Users should upgrade to version 0.50.1 or later to remediate this vulnerability. No other vendor advisories or temporary mitigations are provided.