Fedora alert FEDORA-2026-2c2afa9f9e (cpp-httplib)

From:
             
 
updates--- via package-announce <package-announce@lists.fedoraproject.org>
To:
             
 
package-announce@lists.fedoraproject.org
Subject:
             
 
[SECURITY] Fedora 44 Update: cpp-httplib-0.37.1-2.fc44
Date:
             
 
Fri, 20 Mar 2026 00:18:10 +0000
Message-ID:
             
 
<20260320001810.188C370BEC@bastion01.rdu3.fedoraproject.org>
Archive-link:
             
 
Article
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-2c2afa9f9e
2026-03-20 00:16:04.477762+00:00
--------------------------------------------------------------------------------

Name        : cpp-httplib
Product     : Fedora 44
Version     : 0.37.1
Release     : 2.fc44
URL         : https://github.com/yhirose/cpp-httplib
Summary     : A C++11 single-file header-only cross platform HTTP/HTTPS library
Description :
A C++11 single-file header-only cross platform HTTP/HTTPS library.

It's extremely easy to setup. Just include the httplib.h file in your code!

--------------------------------------------------------------------------------
Update Information:

Update to 0.37.1
Fixes Denial of Service via malformed Content-Length header
  (CVE-2026-31870)
Reenable 32b builds
Update to 0.37.0 (rhbz#2441656)
Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076,
rhbz#2445663)
Update to 0.35.0
Payload size limit bypass via gzip decompression in ContentReader (streaming)
allows oversized request bodies (CVE-2026-28435, rhbz#2444638)
Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response
header (CVE-2026-28434, rhbz#2444636)
https://github.com/yhirose/cpp-httplib/compare/v0.32.0......
--------------------------------------------------------------------------------
ChangeLog:

* Wed Mar 11 2026 Petr Menšík <pemensik@redhat.com> - 0.37.1-2
- Build for 32 bits again
* Tue Mar 10 2026 Petr Menšík <pemensik@redhat.com> - 0.37.1-1
- Update to 0.37.1 (rhbz#2445943)
* Mon Mar  9 2026 Petr Menšík <pemensik@redhat.com> - 0.37.0-1
- Update to 0.37.0 (rhbz#2441656)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2441656 - cpp-httplib-0.37.0 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2441656
  [ 2 ] Bug #2444636 - CVE-2026-28434 cpp-httplib: default exception handler leaks e.what() to
clients via EXCEPTION_WHAT response header [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2444636
  [ 3 ] Bug #2444638 - CVE-2026-28435 cpp-httplib: payload size limit bypass via gzip decompression
in ContentReader (streaming) allows oversized request bodies [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2444638
  [ 4 ] Bug #2445663 - CVE-2026-29076 cpp-httplib: cpp-httplib: Denial of Service via crafted HTTP
POST request [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2445663
  [ 5 ] Bug #2445943 - cpp-httplib-0.37.1 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2445943
  [ 6 ] Bug #2446926 - CVE-2026-31870 cpp-httplib: cpp-httplib: Denial of Service via malformed
Content-Length header [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2446926
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-2c2afa9f9e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgr...

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------



Attachment: None (type=text/plain)
-- 
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond...
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/package-ann...
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new