cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c2049f7220 advisory.

    # Update to 0.37.0 (rhbz#2441656)

    - Fixes Denial of Service via crafted HTTP POST request ([CVE-2026-29076](https://github.com/yhirose/cpp-     httplib/security/advisories/GHSA-qq6v-r583-3h69), rhbz#2445663)

    ## Update to 0.35.0

    - Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request     bodies ([CVE-2026-28435](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xvfx-w463-6fpp),     rhbz#2444638)
    - Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header     ([CVE-2026-28434](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8mpw-r4gc-xm7q),     rhbz#2444636)

    https://github.com/yhirose/cpp-httplib/compare/v0.32.0...v0.37.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6ed9c65eaf advisory.

    # Update to 0.37.1 (rbhz#2445943)

    - Fixes Denial of Service via malformed Content-Length header       ([CVE-2026-31870](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx)
    - Reenables 32-bit build

    # Update to 0.37.0 (rhbz#2441656)

    - Fixes Denial of Service via crafted HTTP POST request ([CVE-2026-29076](https://github.com/yhirose/cpp-     httplib/security/advisories/GHSA-qq6v-r583-3h69), rhbz#2445663)

    ## Update to 0.35.0

    - Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request     bodies ([CVE-2026-28435](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xvfx-w463-6fpp),     rhbz#2444638)
    - Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header     ([CVE-2026-28434](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8mpw-r4gc-xm7q),     rhbz#2444636)

    https://github.com/yhirose/cpp-httplib/compare/v0.32.0...v0.37.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2c2afa9f9e advisory.

    # Update to 0.37.1

    - Fixes Denial of Service via malformed Content-Length header       ([CVE-2026-31870](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx))
    - Reenable 32b builds

    # Update to 0.37.0 (rhbz#2441656)

    - Fixes Denial of Service via crafted HTTP POST request ([CVE-2026-29076](https://github.com/yhirose/cpp-     httplib/security/advisories/GHSA-qq6v-r583-3h69), rhbz#2445663)

    ## Update to 0.35.0

    - Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request     bodies ([CVE-2026-28435](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xvfx-w463-6fpp),     rhbz#2444638)
    - Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header     ([CVE-2026-28434](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8mpw-r4gc-xm7q),     rhbz#2444636)

    https://github.com/yhirose/cpp-httplib/compare/v0.32.0...v0.37.0





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a     request handler throws a C++ exception and the application has not registered a custom exception handler     via set_exception_handler(), the library catches the exception and writes its message directly into the     HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no     authentication check and no special configuration required to trigger it. The behavior is on by default. A     developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal     exception messages to any client. This vulnerability is fixed in 0.35.0. (CVE-2026-28434)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303249	Fedora 43 : cpp-httplib (2026-c2049f7220)	Nessus	Fedora Local Security Checks	medium
303248	Fedora 42 : cpp-httplib (2026-6ed9c65eaf)	Nessus	Fedora Local Security Checks	medium
303120	Fedora 44 : cpp-httplib (2026-2c2afa9f9e)	Nessus	Fedora Local Security Checks	medium
301041	Linux Distros Unpatched Vulnerability : CVE-2026-28434	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-28434

medium

Tenable Plugins

medium

medium

medium

medium