CVE-2026-28434: 
Homebrew vulnerability analysis and mitigation

CVE-2026-28434 is an information disclosure vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. When a request handler throws a C++ exception and no custom exception handler has been registered via set_exception_handler(), the library catches the exception and writes its message verbatim into the HTTP response as a header named EXCEPTION_WHAT, visible to any unauthenticated client. This behavior is enabled by default and affects all versions prior to 0.35.0 (i.e., ≤ 0.34.0). The vulnerability was published on March 4, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-209 (Generation of Error Message Containing Sensitive Information). Inside httplib.h, the server dispatch loop wraps every handler call in a try/catch; if no custom exception_handler_ is registered, the catch (std::exception &e) branch constructs a string from e.what() — escaping only \r and \n — and sets it as the EXCEPTION_WHAT response header via res.set_header("EXCEPTION_WHAT", val). All other content, including file paths, database connection strings, credentials, and class names embedded in exception messages, passes through unchanged to any HTTP client. The fix (commit defd907) simply removes the two res.set_header("EXCEPTION_WHAT", ...) calls from both catch branches (GitHub Advisory, Fix Commit).

Successful exploitation allows any unauthenticated network attacker to read internal application details leaked in HTTP response headers, including internal file paths and config file locations, database connection strings (potentially including credentials), API keys or secrets embedded in exception messages, and internal data structure state. In deployments where exception messages contain secrets or credentials, the advisory notes the effective confidentiality impact should be reassessed as High (CVSS 7.5). There is no integrity or availability impact, but the disclosed information can significantly aid further attacks such as credential reuse or targeted exploitation of internal systems (GitHub Advisory).

A proof-of-concept (PoC) with step-by-step reproduction instructions, including compilable server code and specific curl commands, is publicly available in the GitHub Security Advisory (GitHub Advisory). Exploitation requires no authentication, no special configuration, and no privileges — only the ability to send HTTP requests to a vulnerable server. The EPSS score is approximately 0.042% (low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify servers built with cpp-httplib versions ≤ 0.34.0 using network scanning tools (e.g., Shodan, Censys) or by fingerprinting HTTP responses for characteristic server behaviors.
2. Identify triggerable endpoints: Probe application endpoints with boundary or invalid inputs (e.g., out-of-range IDs, missing config keys, non-numeric values) that are likely to cause the server-side handler to throw a C++ exception.
3. Send crafted HTTP request: Issue a request designed to trigger an exception, for example:

   curl -si "http://target:8080/record?id=999" | grep EXCEPTION_WHAT

4. Read the leaked header: Inspect the HTTP response headers for the EXCEPTION_WHAT header, which contains the raw exception message including any embedded file paths, credentials, database URIs, or other sensitive strings.
5. Leverage disclosed information: Use the leaked details (e.g., database connection strings, API keys, internal paths) to plan further attacks such as credential stuffing, direct database access, or targeted exploitation of internal services (GitHub Advisory).

• Network: Unusual or repeated HTTP requests to application endpoints with boundary/invalid parameters (e.g., very large IDs, non-numeric values, missing keys) from external or unexpected IP addresses; HTTP responses containing the EXCEPTION_WHAT header visible in proxy or WAF logs.
• Logs: Web server or application access logs showing a pattern of 500 Internal Server Error responses to requests with malformed or edge-case parameters; repeated probing of multiple endpoints in quick succession.
• File System: No direct file system artifacts are expected, as exploitation is entirely network-based and passive (read-only information disclosure).
• Process: No unusual process behavior is expected; the vulnerability is triggered by normal request handling within the cpp-httplib server process (GitHub Advisory).

Upgrade cpp-httplib to version 0.35.0 or later, which removes the EXCEPTION_WHAT header insertion entirely (Fix Commit). As an immediate workaround, register a custom exception handler using set_exception_handler() that logs the error internally and returns a generic 500 response without exposing e.what() to clients:

svr.set_exception_handler([](const auto&, auto& res, std::exception_ptr ep) {
    try { if (ep) std::rethrow_exception(ep); }
    catch (const std::exception& e) { fprintf(stderr, "[error] %s\n", e.what()); }
    res.status = 500;
    res.set_content("Internal Server Error", "text/plain");
});

Fedora packages for Fedora 42, 43, and 44 have also received updated packages addressing this CVE (Red Hat Bugzilla).

The vulnerability was reported by researcher 0x3xploit and published via GitHub's security advisory process on March 2, 2026. Red Hat tracked the issue via Bugzilla and assessed it as medium severity. Fedora Linux issued security updates for Fedora 42, 43, and 44. A blog post on infinitsec.net and coverage on linuxsecurity.com highlighted the default-on nature of the leak as a notable design concern for library users (GitHub Advisory, Red Hat Bugzilla).