Skip to content
Fedora 43 cpp-httplib Important DoS Fix 2026

Fedora 43 cpp-httplib Important DoS Fix 2026

Linuxsecurity •LinuxSecurity Advisories • July 3, 2026

Update to 0.48.0 (rhbz#2481109) Security fixes Complete the IP-host certificate identity fix from v0.47.0 for the Mbed TLS and wolfSSL backends. An IP-literal host is now authenticated only via a matching iPAddress SAN, never via the certificate's Common Name (RFC 9110) — matching what the OpenSSL backend already enforces through X509_check_ip. Previously these backends fell back to the CN when no IP SAN matched, and recognized IPv4 only; now IPv6 (16-byte) iPAddress SANs are matched as well, and the CN fallback is skipped for both IPv4 and IPv6 literal hosts (#2476) Improvements Replace the strtod-based from_chars for double with a hand-written, locale-independent parser. The only double parsed by the library is the HTTP quality value; strtod reads the decimal separator from the global C locale, so an embedder calling setlocale(LC_ALL, "") into a comma-decimal locale would mis-parse q-values. The new parser always treats . as the decimal separator and is allocation-free (Fix #247...

* Wed Jun 24 2026 Petr Menšík - 0.48.0-1 - Update to 0.48.0 (rhbz#2481109) * Wed Jun 24 2026 Petr Menšík - 0.47.0-1 - Update to 0.47.0 (rhbz#2481109, CVE-2026-46527, CVE-2026-45372, CVE-2026-45352) * Wed Jun 24 2026 Petr Menšík - 0.38.0-3 - Record upstream tag format in spec * Wed Jun 24 2026 Petr Menšík - 0.38.0-2 - Helper definitions of upstream and signed files

* Wed Jun 24 2026 Petr Menšík - 0.48.0-1 - Update to 0.48.0 (rhbz#2481109) * Wed Jun 24 2026 Petr Menšík - 0.47.0-1 - Update to 0.47.0 (rhbz#2481109, CVE-2026-46527, CVE-2026-45372, CVE-2026-45352) * Wed Jun 24 2026 Petr Menšík - 0.38.0-3 - Record upstream tag format in spec * Wed Jun 24 2026 Petr Menšík - 0.38.0-2 - Helper definitions of upstream and signed files

[ 1 ] Bug #2452170 - CVE-2026-33745 cpp-httplib: cpp-httplib: Information disclosure of credentials via cross-origin HTTP redirects [fedora-43] [ 2 ] Bug #2453749 - CVE-2026-34441 cpp-httplib: cpp-httplib: HTTP Request Smuggling via unconsumed GET request body [fedora-43] [ 3 ] Bug #2481109 - cpp-httplib-0.48.0 is available [ 4 ] Bug #2483726 - CVE-2026-46527 cpp-httplib: cpp-httplib: Denial of Service via malformed X-Forwarded-For header [fedora-all] [ 5 ] Bug #2483733 - CVE-2026-45372 cpp-httplib: cpp-httplib: Arbitrary code execution via improper HTTP header processing [fedora-all] [ 6 ] Bug #2483736 - CVE-2026-45352 cpp-httplib: cpp-httplib: Denial of Service due to unboun...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1d4bd0354a' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.