Update to 0.48.0 (rhbz#2481109) Security fixes Complete the IP-host certificate identity fix from v0.47.0 for the Mbed TLS and wolfSSL backends. An IP-literal host is now authenticated only via a matching iPAddress SAN, never via the certificate's Common Name (RFC 9110) — matching what the OpenSSL backend already enforces through X509_check_ip. Previously these backends fell back to the CN when no IP SAN matched, and recognized IPv4 only; now IPv6 (16-byte) iPAddress SANs are matched as well, and the CN fallback is skipped for both IPv4 and IPv6 literal hosts (#2476) Improvements Replace the strtod-based from_chars for double with a hand-written, locale-independent parser. The only double parsed by the library is the HTTP quality value; strtod reads the decimal separator from the global C locale, so an embedder calling setlocale(LC_ALL, "") into a comma-decimal locale would mis-parse q-values. The new parser always treats . as the decimal separator and is allocation-free (Fix #247...
* Wed Jun 24 2026 Petr Menšík - 0.48.0-1 - Update to 0.48.0 (rhbz#2481109) * Wed Jun 24 2026 Petr Menšík - 0.47.0-1 - Update to 0.47.0 (rhbz#2481109, CVE-2026-46527, CVE-2026-45372, CVE-2026-45352) * Tue May 19 2026 Petr Menšík - 0.45.0-1 - Update to 0.45.0 (rhbz#2450591) * Fri Mar 27 2026 Petr Menšík - 0.39.0-1 - Update to 0.39.0 (rhbz#2450591) * Fri Mar 27 2026 Petr Menšík - 0.38.0-3 - Record upstream tag format in spec * Mon Mar 23 2026 Petr Menšík - 0.38.0-2 - Helper definitions of upstream and signed files
* Wed Jun 24 2026 Petr Menšík - 0.48.0-1 - Update to 0.48.0 (rhbz#2481109) * Wed Jun 24 2026 Petr Menšík - 0.47.0-1 - Update to 0.47.0 (rhbz#2481109, CVE-2026-46527, CVE-2026-45372, CVE-2026-45352) * Tue May 19 2026 Petr Menšík - 0.45.0-1 - Update to 0.45.0 (rhbz#2450591) * Fri Mar 27 2026 Petr Menšík - 0.39.0-1 - Update to 0.39.0 (rhbz#2450591) * Fri Mar 27 2026 Petr Menšík - 0.38.0-3 - Record upstream tag format in spec * Mon Mar 23 2026 Petr Menšík - 0.38.0-2 - Helper definitions of upstream and signed files
[ 1 ] Bug #2452170 - CVE-2026-33745 cpp-httplib: cpp-httplib: Information disclosure of credentials via cross-origin HTTP redirects [fedora-43] [ 2 ] Bug #2481109 - cpp-httplib-0.48.0 is available [ 3 ] Bug #2483726 - CVE-2026-46527 cpp-httplib: cpp-httplib: Denial of Service via malformed X-Forwarded-For header [fedora-all] [ 4 ] Bug #2483733 - CVE-2026-45372 cpp-httplib: cpp-httplib: Arbitrary code execution via improper HTTP header processing [fedora-all] [ 5 ] Bug #2483736 - CVE-2026-45352 cpp-httplib: cpp-httplib: Denial of Service due to unbounded memory allocation via negative chunk-size [fedora-all]
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1b15ac058b' at the command line. For more information, refer to the dnf documentation available at
Get the latest Linux and open source security news straight to your inbox.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
