From 5c248f335f93d50117824beeee9f7381b9a5b8cf Mon Sep 17 00:00:00 2001 From: Stephan Hoffmann Date: Mon, 19 Oct 2026 14:17:26 +0200 Subject: [PATCH] package/libhttpserver: security bump to version 2.0.1 Version 2.0.1 fixes an unauthenticated remote denial of service in version 2.0.0. A single multipart/form-data request containing a file part without a name attribute can terminate the server process. The issue is rated high severity with a CVSS 3.1 score of 7.5. The release also replaces the blocking-start pthread mutex and condition variable with C++20 atomic wait and notify operations. The existing C++20, GCC 11 and threads requirements cover this change. https://github.com/etr/libhttpserver/releases/tag/2.0.1 https://github.com/etr/libhttpserver/security/advisories/GHSA-q8g6-h8wv-pr43 Signed-off-by: Stephan Hoffmann Signed-off-by: Thomas Petazzoni --- package/libhttpserver/libhttpserver.hash | 2 +- package/libhttpserver/libhttpserver.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/libhttpserver/libhttpserver.hash b/package/libhttpserver/libhttpserver.hash index b6b1987464..f4f5263362 100644 --- a/package/libhttpserver/libhttpserver.hash +++ b/package/libhttpserver/libhttpserver.hash @@ -1,3 +1,3 @@ # Locally computed: -sha256 c44d67aba1e4b6767c0fbb895e1acd643601c1e3ee3de7705a59ed09bcd8c92e libhttpserver-2.0.0.tar.gz +sha256 cd6a53302415143abff2db2b92e59d3de837652243717c873d4fb41fe22fbb70 libhttpserver-2.0.1.tar.gz sha256 5df07007198989c622f5d41de8d703e7bef3d0e79d62e24332ee739a452af62a COPYING.LESSER diff --git a/package/libhttpserver/libhttpserver.mk b/package/libhttpserver/libhttpserver.mk index 7b7aedef0d..535c237f5d 100644 --- a/package/libhttpserver/libhttpserver.mk +++ b/package/libhttpserver/libhttpserver.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBHTTPSERVER_VERSION = 2.0.0 +LIBHTTPSERVER_VERSION = 2.0.1 LIBHTTPSERVER_SITE = $(call github,etr,libhttpserver,$(LIBHTTPSERVER_VERSION)) LIBHTTPSERVER_LICENSE = LGPL-2.1+ LIBHTTPSERVER_LICENSE_FILES = COPYING.LESSER