mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
8dad17ea06
See the release notes of intermediate versions: - https://github.com/yhirose/cpp-httplib/releases/tag/v0.28.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.29.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.1 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.2 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.31.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.32.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.1 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.34.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.35.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.36.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.0 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.1 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2 This fixes numerous vulnerabilities: - CVE-2026-21428: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue. https://www.cve.org/CVERecord?id=CVE-2026-21428 - CVE-2026-22776: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library validates the payload_max_length against the compressed data size received from the network, but does not limit the size of the decompressed data stored in memory. https://www.cve.org/CVERecord?id=CVE-2026-22776 - CVE-2026-28434: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0. https://www.cve.org/CVERecord?id=CVE-2026-28434 - CVE-2026-28435: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0. https://www.cve.org/CVERecord?id=CVE-2026-28435 - CVE-2026-29076: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0. https://www.cve.org/CVERecord?id=CVE-2026-29076 - CVE-2026-31870: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non- numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1. https://www.cve.org/CVERecord?id=CVE-2026-31870 - CVE-2026-32627: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2. https://www.cve.org/CVERecord?id=CVE-2026-32627 Signed-off-by: Titouan Christophe <titouan.christophe@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches