https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T12:34:43.248002+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-28434 CVE-2026-28434 — cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header 2026-10-01T12:34:43.253621+00:00

Affected: yhirose cpp-httplib

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.