Threats Tagged 'cve-2026-46527'

Multiple security issues have been fixed in the cpp-httplib-devel-0.46.1-1.1 package on the GA media of openSUSE Tumbleweed. The vulnerabilities involve CWE-93 (Improper Neutralization of CRLF Sequences) and CWE-444 (Inconsistent Interpretation of HTTP Requests). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and impacts including low confidentiality, high integrity, and low availability. No known exploits are reported in the wild. The package affects SUSE on aarch64 and ppc64le architectures. Patch or remediation status is not confirmed from the available data.

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.