{"id":"openSUSE-SU-2026:20733-1","summary":"Security update for cpp-httplib","details":"This update for cpp-httplib fixes the following issues\n\n- CVE-2026-21428: server-side request forgery via header injection (bsc#1255835).\n- CVE-2026-22776: unsafe handling of compressed HTTP request can cause a denial of service (bsc#1256518).\n- CVE-2026-28434: default exception handler may leak e.what() to clients via EXCEPTION_WHAT response header\n  (bsc#1259221).\n- CVE-2026-28435: payload size limit bypass via gzip decompression in ContentReader (streaming) can lead to denial of\n  service (bsc#1259220).\n- CVE-2026-29076: denial of service via crafted HTTP POST request (bsc#1259373).\n","modified":"2026-05-19T18:23:46.734404115Z","published":"2026-05-08T10:00:29Z","related":["CVE-2026-21428","CVE-2026-22776","CVE-2026-28434","CVE-2026-28435","CVE-2026-29076"],"upstream":["CVE-2026-21428","CVE-2026-22776","CVE-2026-28434","CVE-2026-28435","CVE-2026-29076"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1255835"},{"type":"REPORT","url":"https://bugzilla.suse.com/1256518"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259220"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259221"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259373"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-21428"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-22776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-28434"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-28435"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-29076"}],"schema_version":"1.7.5"}