{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"Critical" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"cpp-httplib security update", "category":"general", "title":"Synopsis" }, { "text":"An update for cpp-httplib is now available for openEuler-24.03-LTS-SP1", "category":"general", "title":"Summary" }, { "text":"A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code!\n\nSecurity Fix(es):\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul(\"-2\", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of \"-1\"), but any other negative value such as \"-2\" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.(CVE-2026-45352)\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \\r\\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.(CVE-2026-45372)\n\ncpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.(CVE-2026-46527)", "category":"general", "title":"Description" }, { "text":"An update for cpp-httplib is now available for master/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"Critical", "category":"general", "title":"Severity" }, { "text":"cpp-httplib", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-2586", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2586" }, { "summary":"CVE-2026-45352", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-45352&packageName=cpp-httplib" }, { "summary":"CVE-2026-45372", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-45372&packageName=cpp-httplib" }, { "summary":"CVE-2026-46527", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-46527&packageName=cpp-httplib" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45352" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45372" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46527" }, { "summary":"openEuler-SA-2026-2586 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-2586.json" } ], "title":"An update for cpp-httplib is now available for openEuler-24.03-LTS-SP1", "tracking":{ "initial_release_date":"2026-06-08T15:01:39+08:00", "revision_history":[ { "date":"2026-06-08T15:01:39+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-06-08T15:01:39+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-06-08T15:01:39+08:00", "id":"openEuler-SA-2026-2586", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"openEuler-24.03-LTS-SP1", "name":"openEuler-24.03-LTS-SP1" }, "name":"openEuler-24.03-LTS-SP1", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-0.46.0-1.oe2403sp1.aarch64.rpm", "name":"cpp-httplib-0.46.0-1.oe2403sp1.aarch64.rpm" }, "name":"cpp-httplib-0.46.0-1.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64.rpm", "name":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64.rpm" }, "name":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64.rpm", "name":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64.rpm" }, "name":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64.rpm", "name":"cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64.rpm" }, "name":"cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-0.46.0-1.oe2403sp1.src.rpm", "name":"cpp-httplib-0.46.0-1.oe2403sp1.src.rpm" }, "name":"cpp-httplib-0.46.0-1.oe2403sp1.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-0.46.0-1.oe2403sp1.x86_64.rpm", "name":"cpp-httplib-0.46.0-1.oe2403sp1.x86_64.rpm" }, "name":"cpp-httplib-0.46.0-1.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64.rpm", "name":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64.rpm" }, "name":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64.rpm", "name":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64.rpm" }, "name":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64.rpm", "name":"cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64.rpm" }, "name":"cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-0.46.0-1.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "name":"cpp-httplib-0.46.0-1.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "name":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "name":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "name":"cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-0.46.0-1.oe2403sp1.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "name":"cpp-httplib-0.46.0-1.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-0.46.0-1.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "name":"cpp-httplib-0.46.0-1.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "name":"cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "name":"cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64", "name":"cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-45352", "notes":[ { "text":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul(\"-2\", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of \"-1\"), but any other negative value such as \"-2\" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ], "details":"cpp-httplib security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2586" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.3, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-45352" }, { "cve":"CVE-2026-45372", "notes":[ { "text":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \\r\\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ], "details":"cpp-httplib security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2586" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.9, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-45372" }, { "cve":"CVE-2026-46527", "notes":[ { "text":"cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ], "details":"cpp-httplib security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2586" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.7, "vectorString":"CVSS:3.1/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.src", "openEuler-24.03-LTS-SP1:cpp-httplib-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debuginfo-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-debugsource-0.46.0-1.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:cpp-httplib-devel-0.46.0-1.oe2403sp1.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-46527" } ] }