Critical Security Flaws in cpp-httplib Affect Fedora Systems

Fedora has released an update for cpp-httplib, addressing multiple critical vulnerabilities. The update includes fixes for CVE-2026-46527, CVE-2026-45372, and CVE-2026-45352, which involve denial of service and arbitrary code execution through improper HTTP header processing. The vulnerabilities affect Fedora 43 and 44, with potential exploitation leading to significant disruptions. The IP-host certificate identity fix ensures that IP-literal hosts are authenticated correctly, enhancing security against previous fallback mechanisms. Users are advised to upgrade to version 0.48.0 immediately to mitigate risks. The vulnerabilities were disclosed in late May 2026, and patches are available through the dnf update program.

Key Points: • Fedora's cpp-httplib update addresses critical vulnerabilities including DoS and code execution. • Affected CVEs include CVE-2026-46527, CVE-2026-45372, and CVE-2026-45352. • Users must upgrade to version 0.48.0 to protect against these vulnerabilities.