{"id":"SUSE-SU-2026:21599-1","summary":"Security update for cpp-httplib","details":"This update for cpp-httplib fixes the following issues\n\n- CVE-2026-21428: server-side request forgery via header injection (bsc#1255835).\n- CVE-2026-22776: unsafe handling of compressed HTTP request can cause a denial of service (bsc#1256518).\n- CVE-2026-28434: default exception handler may leak e.what() to clients via EXCEPTION_WHAT response header\n  (bsc#1259221).\n- CVE-2026-28435: payload size limit bypass via gzip decompression in ContentReader (streaming) can lead to denial of\n  service (bsc#1259220).\n- CVE-2026-29076: denial of service via crafted HTTP POST request (bsc#1259373).\n","modified":"2026-05-16T18:25:06.451828Z","published":"2026-05-08T10:00:52Z","related":["CVE-2026-21428","CVE-2026-22776","CVE-2026-28434","CVE-2026-28435","CVE-2026-29076"],"upstream":["CVE-2026-21428","CVE-2026-22776","CVE-2026-28434","CVE-2026-28435","CVE-2026-29076"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621599-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1255835"},{"type":"REPORT","url":"https://bugzilla.suse.com/1256518"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259220"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259221"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259373"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-21428"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-22776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-28434"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-28435"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-29076"}],"schema_version":"1.7.5"}