Back Linuxsecurity

Fedora 44 cpp-httplib Update 0.37.1 Denial of Service CVE-2026

Linuxsecurity •LinuxSecurity Advisories • March 20, 2026

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include the httplib.h file in your code! Update Information : Update to 0.37.1 Fixes Denial of Service via malformed Content-Length header (CVE-2026-31870) Reenable 32b builds Update to 0.37.0 (rhbz#2441656) Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076, rhbz#2445663) Update to 0.35.0 Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies (CVE-2026-28435, rhbz#2444638) Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVE-2026-28434, rhbz#2444636)

A C++11 single-file header-only cross platform HTTP/HTTPS library.

It's extremely easy to setup. Just include the httplib.h file in your code!

Update to 0.37.1 Fixes Denial of Service via malformed Content-Length header (CVE-2026-31870) Reenable 32b builds Update to 0.37.0 (rhbz#2441656) Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076, rhbz#2445663) Update to 0.35.0 Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies (CVE-2026-28435, rhbz#2444638) Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVE-2026-28434, rhbz#2444636)

* Wed Mar 11 2026 Petr Men\u0161k - 0.37.1-2 - Build for 32 bits again * Tue Mar 10 2026 Petr Men\u0161k - 0.37.1-1 - Update to 0.37.1 (rhbz#2445943) * Mon Mar 9 2026 Petr Men\u0161k - 0.37.0-1 - Update to 0.37.0 (rhbz#2441656)

[ 1 ] Bug #2441656 - cpp-httplib-0.37.0 is available [ 2 ] Bug #2444636 - CVE-2026-28434 cpp-httplib: default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header [fedora-all] [ 3 ] Bug #2444638 - CVE-2026-28435 cpp-httplib: payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies [fedora-all] [ 4 ] Bug #2445663 - CVE-2026-29076 cpp-httplib: cpp-httplib: Denial of Service via crafted HTTP POST request [fedora-all] [ 5 ] Bug #2445943 - cpp-httplib-0.37.1 is available [ 6 ] Bug #2446926 - CVE-2026-31870 cpp-httplib: cpp-httplib: Denial of Service via malformed Content-Length header [fedora-all] ... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-2c2afa9f9e' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Denial of Service Vulnerabilities in cpp-httplib Affect Fedora Users Recent updates to the cpp-httplib library in Fedora address multiple critical Denial of Service (DoS) vulnerabilities. The vulnerabilities include CVE-2026-29076, which allows DoS via crafted HTTP POST requests, and CVE-2026-31870, which exploits malformed Content-Length headers. These vulnerabilities affect users of Fedora 43 and 44 who utilize the cpp-httplib library for HTTP/HTTPS operations. The updates also address issues related to payload size limit bypass and exception handling that could leak sensitive information. The patches were released on March 9, 2026, for version 0.37.0 and on March 11, 2026, for version 0.37.1. Users are urged to update their libraries to mitigate these risks. The vulnerabilities have been confirmed and are considered critical due to their potential impact on system availability and security. 3 sources 73

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (4)

CVE-2026-28434 CVE-2026-28435 CVE-2026-29076 CVE-2026-31870