Most recent entries from all

bdu:2026-07650

EUVD-2026-323547

fkie_cve-2026-45372

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

OESA-2026-2585 — cpp-httplib security update

Affected: openEuler:24.03-LTS-SP3: cpp-httplib

A C++11 single-file header-only cross platform HTTP/HTTPS library. It&apos;s extremely easy to setup. Just include httplib.h file in your code! Security Fix(es):

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.(CVE-2026-45352)

openSUSE-SU-2026:10994-1 — cpp-httplib-devel-0.46.1-1.1 on GA media

cpp-httplib-devel-0.46.1-1.1 on GA media

UBUNTU-CVE-2026-45372

Affected: Ubuntu:Pro:22.04:LTS: cpp-httplib, Ubuntu:Pro:24.04:LTS: cpp-httplib, Ubuntu:25.10: cpp-httplib, Ubuntu:Pro:26.04:LTS: cpp-httplib