cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-03599f0b32 advisory.

    # Update to 0.38.0 (rhbz#2447261)


    - Filename sanitization for path traversal prevention  Added sanitize_filename() to prevent path     traversal attacks via malicious filenames in multipart uploads (83e98a2)
    - Symlink protection in static file server  Static file serving now detects and rejects symlinks that     point outside the mount directory, preventing symlink-based directory traversal (f787f31)


    - Brotli compression support  Added Brotli (br) as a supported content encoding alongside gzip and     deflate (ec1ffbc)
    - Accept-Encoding quality parameter parsing  The server now parses q= quality values in the Accept-     Encoding header and selects the best encoding accordingly (bb7c7ab)
    - SSL proxy connection support  SSLClient can now establish connections through HTTPS proxies, with a     new setup_proxy_connection method for cleaner proxy handling (f6ed5fc, b1bb2b7)
    - WebSocket ping interval runtime configuration  WebSocket ping interval can now be configured at     runtime instead of only at compile time (257b266)


    - Benchmark test suite  Added benchmark tests and configurations for performance evaluation (ba0d0b8)
    - Unicode path component decoding tests  Added test coverage for Unicode characters in     decode_path_component (43a54a3)
    - Documentation updates  Enhanced TLS backend documentation with platform-specific certificate handling     details; clarified progress callback usage and user data handling in examples (511e3ef, 2e61fd3)


    - Fix port conflict in test  Fixed port number in OpenStreamMalformedContentLength test to avoid     conflicts (4978f26)


    - Removed large data tests for GzipDecompressor and SSLClientServerTest that caused memory issues     (5ecba74, 69d468f)
    - Enabled BindDualStack test (69d468f)

    Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.38.0


    - Fixes silent TLS certificate verification bypass on HTTPS Redirect via     proxy ([CVE-2026-32627](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g),     rhbz#2448105)

    Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2

    [//]: # (#2448104 NEW        - davide@cavalca.name - CVE-2026-32627 cpp-httplib: silent TLS certificate     verification bypass on HTTPS Redirect via proxy [epel-all])     [//]: # (#2448105 CLOSED     - pemensik@redhat.com - CVE-2026-32627 cpp-httplib: silent TLS certificate     verification bypass on HTTPS Redirect via proxy [fedora-all])

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-04a531cece advisory.

    # Update to 0.37.2

    - Fixes silent TLS certificate verification bypass on HTTPS Redirect via     proxy ([CVE-2026-32627](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g),     rhbz#2448105)

    Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2

    [//]: # (#2448104 NEW        - davide@cavalca.name - CVE-2026-32627 cpp-httplib: silent TLS certificate     verification bypass on HTTPS Redirect via proxy [epel-all])     [//]: # (#2448105 CLOSED     - pemensik@redhat.com - CVE-2026-32627 cpp-httplib: silent TLS certificate     verification bypass on HTTPS Redirect via proxy [fedora-all])

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e76feaf213 advisory.

    # Update to 0.38.0 (rhbz#2447261)


    - Filename sanitization for path traversal prevention  Added sanitize_filename() to prevent path     traversal attacks via malicious filenames in multipart uploads (83e98a2)
    - Symlink protection in static file server  Static file serving now detects and rejects symlinks that     point outside the mount directory, preventing symlink-based directory traversal (f787f31)


    - Brotli compression support  Added Brotli (br) as a supported content encoding alongside gzip and     deflate (ec1ffbc)
    - Accept-Encoding quality parameter parsing  The server now parses q= quality values in the Accept-     Encoding header and selects the best encoding accordingly (bb7c7ab)
    - SSL proxy connection support  SSLClient can now establish connections through HTTPS proxies, with a     new setup_proxy_connection method for cleaner proxy handling (f6ed5fc, b1bb2b7)
    - WebSocket ping interval runtime configuration  WebSocket ping interval can now be configured at     runtime instead of only at compile time (257b266)


    - Benchmark test suite  Added benchmark tests and configurations for performance evaluation (ba0d0b8)
    - Unicode path component decoding tests  Added test coverage for Unicode characters in     decode_path_component (43a54a3)
    - Documentation updates  Enhanced TLS backend documentation with platform-specific certificate handling     details; clarified progress callback usage and user data handling in examples (511e3ef, 2e61fd3)


    - Fix port conflict in test  Fixed port number in OpenStreamMalformedContentLength test to avoid     conflicts (4978f26)


    - Removed large data tests for GzipDecompressor and SSLClientServerTest that caused memory issues     (5ecba74, 69d468f)
    - Enabled BindDualStack test (69d468f)

    Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.38.0


    - Fixes silent TLS certificate verification bypass on HTTPS Redirect via     proxy ([CVE-2026-32627](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g),     rhbz#2448105)

    Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2

    [//]: # (#2448104 NEW        - davide@cavalca.name - CVE-2026-32627 cpp-httplib: silent TLS certificate     verification bypass on HTTPS Redirect via proxy [epel-all])     [//]: # (#2448105 CLOSED     - pemensik@redhat.com - CVE-2026-32627 cpp-httplib: silent TLS certificate     verification bypass on HTTPS Redirect via proxy [fedora-all])     [//]: # (#2447261 rebase)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-06d1b46d1e advisory.

    Automatic update for cpp-httplib-0.38.0-1.fc45.

    ##### **Changelog**

    ```
    * Tue Mar 17 2026 Petr Menk <pemensik@redhat.com> - 0.38.0-1
    - Update to 0.38.0 (rhbz#2447261)
    * Tue Mar 17 2026 Petr Menk <pemensik@redhat.com> - 0.37.2-1
    - Update to 0.37.2
    - Fixes silent TLS certificate verification bypass on HTTPS Redirect via       proxy (CVE-2026-32627, rhbz#2448105)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a     cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows     will have TLS certificate and hostname verification silently disabled on the new connection. The client     will accept any certificate presented by the redirect target  expired, self-signed, or forged  without     raising an error or notifying the application. A network attacker in a position to return a redirect     response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens     in flight. This vulnerability is fixed in 0.37.2. (CVE-2026-32627)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304458	Fedora 44 : cpp-httplib (2026-03599f0b32)	Nessus	Fedora Local Security Checks	high
304456	Fedora 42 : cpp-httplib (2026-04a531cece)	Nessus	Fedora Local Security Checks	high
304453	Fedora 43 : cpp-httplib (2026-e76feaf213)	Nessus	Fedora Local Security Checks	high
302757	Fedora 45 : cpp-httplib (2026-06d1b46d1e)	Nessus	Fedora Local Security Checks	high
302266	Linux Distros Unpatched Vulnerability : CVE-2026-32627	Nessus	Misc.	high

Detections

Analytics

CVE-2026-32627

high

Tenable Plugins

high

high

high

high

high