A use-after-free vulnerability in the yhirose cpp-httplib library poses a high risk of service disruption for applications utilizing TLS-enabled WebSockets.

This is a use-after-free vulnerability occurring when a TLS-enabled WebSocket client improperly frees a TLS session before closing the associated WebSocket, leading to memory corruption. The vulnerability is reachable by an unauthenticated attacker during ordinary connection teardown, destruction, or reconnection processes.

The exploitation of this vulnerability results in high availability impact, as the use-after-free condition typically leads to application crashes or unpredictable behavior. Given the CVSS score of 8.2, this issue is considered high severity, as it can be triggered by remote, unauthenticated actors, potentially causing significant downtime for services relying on secure WebSocket communications.

Immediate Action: Update the cpp-httplib library to version 0.50.1 or later to incorporate the necessary memory management fixes.

Proactive Monitoring: Monitor application logs and system error reports for recurring segmentation faults or unexpected crashes during WebSocket connection termination.

Compensating Controls: While specific WAF rules may not prevent memory-level vulnerabilities, ensuring that applications are running in sandboxed environments can limit the impact of potential crashes or code execution attempts.

Public Exploit Available: No

Organizations using the cpp-httplib library should prioritize updating to version 0.50.1 immediately. Given the ease of triggering this vulnerability through standard connection teardown, failing to patch may lead to service instability and denial-of-service conditions.