{"schema_version":"1.7.2","id":"OESA-2026-1555","modified":"2026-03-15T05:53:11Z","published":"2026-03-15T05:53:11Z","upstream":["CVE-2026-28434","CVE-2026-28435","CVE-2026-29076"],"summary":"cpp-httplib security update","details":"A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code!\r\n\r\nSecurity Fix(es):\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.(CVE-2026-28434)\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.(CVE-2026-28435)\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.(CVE-2026-29076)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS","name":"cpp-httplib","purl":"pkg:rpm/openEuler/cpp-httplib&distro=openEuler-24.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37.0-1.oe2403"}]}],"ecosystem_specific":{"aarch64":["cpp-httplib-0.37.0-1.oe2403.aarch64.rpm","cpp-httplib-debuginfo-0.37.0-1.oe2403.aarch64.rpm","cpp-httplib-debugsource-0.37.0-1.oe2403.aarch64.rpm","cpp-httplib-devel-0.37.0-1.oe2403.aarch64.rpm"],"src":["cpp-httplib-0.37.0-1.oe2403.src.rpm"],"x86_64":["cpp-httplib-0.37.0-1.oe2403.x86_64.rpm","cpp-httplib-debuginfo-0.37.0-1.oe2403.x86_64.rpm","cpp-httplib-debugsource-0.37.0-1.oe2403.x86_64.rpm","cpp-httplib-devel-0.37.0-1.oe2403.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1555"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28434"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28435"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29076"}],"database_specific":{"severity":"High"}}