AIKIDO-2026-96482
yhirose.cpp-httplib is vulnerable to Use-After-Free
56
Medium Risk
This Affects:
yhirose.cpp-httplibTL;DR
The WebSocketClient::shutdown_and_close routine frees the TLS session before the WebSocket close frame is sent over a wss connection. The WebSocket stream keeps a raw pointer to that freed session, so sending the close frame reads and writes already-released SSL memory. A secure WebSocket client that is destroyed or reconnected while a connection is still open triggers the use-after-free, which can crash the process or corrupt memory. The fix sends the close frame while the session is still valid and frees the session only afterward.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the secure WebSocket (wss) client.
Background info
yhirose.cpp-httplib is vulnerable to Use-After-Free in versions 0.33.0 - 0.50.0.
How to fix this
Upgrade the yhirose.cpp-httplib library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.