Open
Fix CVE-2026-45372 in cpp-httplib for 22.03 SP4 #115
jixiangAdd on Jul 10
Fix CVE-2026-45372 in cpp-httplib for 22.03 SP4 #115
Open
Total: 2 files changed+43-2
| @@ -0,0 +1,39 @@ | |||
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Ji Xiang <qfmy_250803@qq.com> | ||
| 3 | +Date: Fri, 10 Jul 2026 17:20:00 +0800 | ||
| 4 | +Subject: [PATCH] Fix CVE-2026-45372 | ||
W | |||
| 5 | + | ||
| 6 | +Do not percent-decode HTTP header field values while parsing request | ||
| 7 | +headers. Header values are opaque octets; decoding after validating the | ||
| 8 | +raw value can turn an encoded CR/LF sequence such as %0D%0A into a | ||
| 9 | +literal header line break in the stored value. | ||
| 10 | + | ||
| 11 | +Signed-off-by: Ji Xiang <qfmy_250803@qq.com> | ||
| 12 | +--- | ||
| 13 | + httplib.h | 11 +++++------ | ||
| 14 | + 1 file changed, 5 insertions(+), 6 deletions(-) | ||
| 15 | + | ||
| 16 | +diff --git a/httplib.h b/httplib.h | ||
| 17 | +index 1111111..2222222 100644 | ||
| 18 | +--- a/httplib.h | ||
| 19 | ++++ b/httplib.h | ||
| 20 | +@@ -4675,12 +4675,11 @@ inline bool parse_header(const char *beg, const char *end, | ||
| 21 | + | ||
| 22 | + if (!detail::fields::is_field_value(val)) { return false; } | ||
| 23 | + | ||
| 24 | +- if (case_ignore::equal(key, "Location") || | ||
| 25 | +- case_ignore::equal(key, "Referer")) { | ||
| 26 | +- fn(key, val); | ||
| 27 | +- } else { | ||
| 28 | +- fn(key, decode_path_component(val)); | ||
| 29 | +- } | ||
| 30 | ++ // RFC 9110 section 5.5: header field values are opaque octets and | ||
| 31 | ++ // must not be percent-decoded by the recipient. Applications that | ||
| 32 | ++ // intentionally interpret a header value as a URI component should | ||
| 33 | ++ // call decode_path_component or decode_query_component explicitly. | ||
| 34 | ++ fn(key, val); | ||
| 35 | + | ||
| 36 | + return true; | ||
| 37 | + } | ||
| 38 | +-- | ||
| 39 | +2.49.0 | ||
| @@ -1,11 +1,12 @@ | |||
| 1 | Name: cpp-httplib | 1 | Name: cpp-httplib |
| 2 | Version: 0.27.0 | 2 | Version: 0.27.0 |
| 3 | -Release: 1 | 3 | +Release: 2 |
| 4 | Summary: A C++ header-only HTTP/HTTPS server and client library | 4 | Summary: A C++ header-only HTTP/HTTPS server and client library |
| 5 | License: MIT | 5 | License: MIT |
| 6 | URL: https://github.com/yhirose/cpp-httplib | 6 | URL: https://github.com/yhirose/cpp-httplib |
| 7 | Source0: https://github.com/yhirose/cpp-httplib/archive/v%{version}/%{name}-%{version}.tar.gz | 7 | Source0: https://github.com/yhirose/cpp-httplib/archive/v%{version}/%{name}-%{version}.tar.gz |
| 8 | Patch0: remove-REMOTE_PORT-dependency.patch | 8 | Patch0: remove-REMOTE_PORT-dependency.patch |
| 9 | +Patch1: CVE-2026-45372-no-percent-decode-headers.patch | ||
| 9 | BuildRequires: gcc-c++ | 10 | BuildRequires: gcc-c++ |
| 10 | BuildRequires: cmake | 11 | BuildRequires: cmake |
| 11 | BuildRequires: pkgconfig(libcurl) | 12 | BuildRequires: pkgconfig(libcurl) |
| @@ -67,6 +68,8 @@ cd - | |||
| 67 | %{_libdir}/cmake/httplib | 68 | %{_libdir}/cmake/httplib |
| 68 | 69 | ||
| 69 | %changelog | 70 | %changelog |
| 71 | +* Fri Jul 10 2026 Ji Xiang <qfmy_250803@qq.com> - 0.27.0-2 | ||
| 72 | +- Fix CVE-2026-45372: avoid percent-decoding HTTP header field values | ||
| 70 | * Mon Dec 08 2025 yaoxin <1024769339@qq.com> - 0.27.0-1 | 73 | * Mon Dec 08 2025 yaoxin <1024769339@qq.com> - 0.27.0-1 |
| 71 | - Update to 0.27.0 for fix CVE-2025-66570 and CVE-2025-66577 | 74 | - Update to 0.27.0 for fix CVE-2025-66570 and CVE-2025-66577 |
| 72 | 75 | ||
| @@ -93,4 +96,3 @@ cd - | |||
| 93 | 96 | ||
| 94 | * Sun Mar 29 2020 Wei Xiong <myeuler@163.com> | 97 | * Sun Mar 29 2020 Wei Xiong <myeuler@163.com> |
| 95 | - Package init | 98 | - Package init |
| 96 | - | ||
This code comment section is from+1To+4
非原创补丁需要保持补丁头与上游一致 https://github.com/yhirose/cpp-httplib/commit/fbb031ed8504a0e48d9ca63caecc0614c296f755.patch
如何确认该补丁为 CVE 修复补丁，是否有根据 poc 验证 https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m