Fedora alert FEDORA-2026-1d4bd0354a (cpp-httplib)
| From: | updates--- via package-announce <package-announce@lists.fedoraproject.org> | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 43 Update: cpp-httplib-0.48.0-1.fc43 | |
| Date: | Fri, 03 Jul 2026 01:09:58 +0000 | |
| Message-ID: | <20260703010958.6E6226CE8B@bastion01.rdu3.fedoraproject.org> | |
| Archive-link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-1d4bd0354a 2026-07-03 01:08:59.045303+00:00 -------------------------------------------------------------------------------- Name : cpp-httplib Product : Fedora 43 Version : 0.48.0 Release : 1.fc43 URL : https://github.com/yhirose/cpp-httplib Summary : A C++11 single-file header-only cross platform HTTP/HTTPS library Description : A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include the httplib.h file in your code! -------------------------------------------------------------------------------- Update Information: Update to 0.48.0 (rhbz#2481109) Security fixes Complete the IP-host certificate identity fix from v0.47.0 for the Mbed TLS and wolfSSL backends. An IP-literal host is now authenticated only via a matching iPAddress SAN, never via the certificate's Common Name (RFC 9110) — matching what the OpenSSL backend already enforces through X509_check_ip. Previously these backends fell back to the CN when no IP SAN matched, and recognized IPv4 only; now IPv6 (16-byte) iPAddress SANs are matched as well, and the CN fallback is skipped for both IPv4 and IPv6 literal hosts (#2476) Improvements Replace the strtod-based from_chars for double with a hand-written, locale-independent parser. The only double parsed by the library is the HTTP quality value; strtod reads the decimal separator from the global C locale, so an embedder calling setlocale(LC_ALL, "") into a comma-decimal locale would mis-parse q-values. The new parser always treats . as the decimal separator and is allocation-free (Fix #2475) Fix OpenSSL 4.0 deprecation warnings: fetch CA store objects via the thread-safe X509_STORE_get1_objects() (OpenSSL 3.3+) and extract the subject CN via X509_NAME_get_index_by_NID()/X509_NAME_get_entry() instead of the deprecated X509_STORE_get0_objects() and X509_NAME_get_text_by_NID(). Older OpenSSL, BoringSSL, and LibreSSL keep using the get0 path. Verified warning-free against OpenSSL 4.0.1, 3.6.2, and 3.0 Behavior changes decode_query_component() now uses strict hex parsing for percent-escapes, consistent with decode_uri_component() and decode_path_component(). A % followed by non-hex characters (e.g. a sign or whitespace such as %-1, %+5, % 5) is passed through literally instead of being accepted as a valid escape (#2472) Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.48.0 Update to 0.47.0 (rhbz#2481109, CVE-2026-46527, CVE-2026-45372, CVE-2026-45352) Security fixes Fix TLS certificate chain verification bypass for IP-literal hosts on the Mbed TLS and wolfSSL backends: with server certificate verification enabled, SSLClient skipped chain validation entirely (any untrusted certificate with a matching IP SAN was accepted), and WebSocketClient on Mbed TLS skipped verification altogether. Chain verification now stays enabled for IP hosts, and certificate identity is verified post-handshake against IP SANs on all backends. SNI is no longer sent for IP hosts on Mbed TLS and wolfSSL, per RFC 6066 (CVE-2026-54919) New features Add Server::set_start_handler(): a callback invoked when the server is ready to accept connections, useful when running the server in a background thread (#2467) Add Client/SSLClient/WebSocketClient::enable_system_ca(bool) to opt into loading system CA certificates alongside a custom CA. The default is unchanged: a custom CA remains exclusive. The setting carries over to clients created for HTTPS redirects (#2471) Add WebSocketClient::set_hostname_addr_map() to connect to a specific IP address while keeping the original hostname for the handshake and certificate verification (#2463) Behavior changes The request body is now read after route matching and the pre-request handler, so both the regular handler and ContentReader paths behave the same: route matching → pre-request handler → body read → handler. A request rejected by the pre-request handler (e.g. failed per-route authentication via req.matched_route) no longer buffers the body at all. Note: code that referenced req.body or body- derived form fields inside the pre-request handler will now see an empty body; inspect headers, path, query parameters, or matched_route instead WebSocketClient with a custom CA no longer merges system CA certificates (it previously always merged them). This matches SSLClient behavior; call enable_system_ca(true) to load system CA certificates alongside the custom CA Range request headers are now ignored for streaming responses of unknown length instead of producing an invalid response (#2465) Bug fixes Fix SSLClient::set_ca_cert_store() breaking custom-CA exclusivity: system CA certificates were silently merged into the user-provided store, broadening the trust set. Also fix Client::load_ca_cert_store() not carrying CA certificates over to clients created for HTTPS redirects Fix WebSocketClient dropping the query string from the URL during the upgrade handshake, so query parameters (e.g. auth tokens) are sent (#2468) Fix a use-after-free when reconnecting a WebSocketClient after set_ca_cert_store(), and a memory leak in the Mbed TLS and wolfSSL set_ca_cert_store() backends Fix MSVC warning C4309 (truncation of constant value) in SHA padding code (#2464) Cast to unsigned char before ctype calls in is_hex and is_token_char to avoid undefined behavior with negative char values (#2469) Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.47.0 -------------------------------------------------------------------------------- ChangeLog: * Wed Jun 24 2026 Petr Menšík <pemensik@redhat.com> - 0.48.0-1 - Update to 0.48.0 (rhbz#2481109) * Wed Jun 24 2026 Petr Menšík <pemensik@redhat.com> - 0.47.0-1 - Update to 0.47.0 (rhbz#2481109, CVE-2026-46527, CVE-2026-45372, CVE-2026-45352) * Wed Jun 24 2026 Petr Menšík <pemensik@redhat.com> - 0.38.0-3 - Record upstream tag format in spec * Wed Jun 24 2026 Petr Menšík <pemensik@redhat.com> - 0.38.0-2 - Helper definitions of upstream and signed files -------------------------------------------------------------------------------- References: [ 1 ] Bug #2452170 - CVE-2026-33745 cpp-httplib: cpp-httplib: Information disclosure of credentials via cross-origin HTTP redirects [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2452170 [ 2 ] Bug #2453749 - CVE-2026-34441 cpp-httplib: cpp-httplib: HTTP Request Smuggling via unconsumed GET request body [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2453749 [ 3 ] Bug #2481109 - cpp-httplib-0.48.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2481109 [ 4 ] Bug #2483726 - CVE-2026-46527 cpp-httplib: cpp-httplib: Denial of Service via malformed X-Forwarded-For header [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2483726 [ 5 ] Bug #2483733 - CVE-2026-45372 cpp-httplib: cpp-httplib: Arbitrary code execution via improper HTTP header processing [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2483733 [ 6 ] Bug #2483736 - CVE-2026-45352 cpp-httplib: cpp-httplib: Denial of Service due to unbounded memory allocation via negative chunk-size [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2483736 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1d4bd0354a' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgr... All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
Attachment: None (type=text/plain)
-- _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond... List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-ann... Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new