Open
Fix CVE-2026-45372 in cpp-httplib for 22.03 SP4 #115
Fix CVE-2026-45372 in cpp-httplib for 22.03 SP4 #115
Open
jixiangAdd on Jul 10
jixiang
jixiang
Jul 10

Backport the upstream header parsing hardening for CVE-2026-45372 to openEuler-22.03-LTS-SP4.

openEuler CVE status:

  • Package: cpp-httplib
  • CVE: CVE-2026-45372
  • openEuler score: 9.9
  • Affected branch: openEuler-22.03-LTS-SP4 (cpp-httplib 0.27.0)

Fix:

  • Keep the existing 0.27.0 source package.
  • Add CVE-2026-45372-no-percent-decode-headers.patch.
  • Stop percent-decoding HTTP header field values in parse_header(). Header field values are opaque octets; applications that intentionally interpret a header value as a URI component can decode explicitly.

Validation:

  • Confirmed vulnerable 0.27.0 code validates the raw header value, then decodes non-Location/Referer values with decode_path_component(). Encoded %0D%0A can therefore become literal CR/LF after validation.
  • Confirmed fixed 0.46.0/openEuler newer-branch code stores header values without percent-decoding.
  • Verified the backport patch applies cleanly to cpp-httplib-0.27.0.

Signed-off-by: Ji Xiang qfmy_250803@qq.com

likedislike
Merge blocked
jixiangjixiang
Jul 10 Created pull request, commit c90fc40c
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Set licihua,overweight,jingxiaolu,yanan-rock,fcwicky as approver
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Added label: sig/dev-utils
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 10 Comments:

Welcome To openEuler Community

Hey @gca_u2301_82052726 , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: dev-utils ,
and any of the maintainers: @fcwicky, @jingxiaolu, @licihua, @overweight, @yanan-rock ,
and any of the committers: @caodongxia, @wang--ge, @wk333 .

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 10 Comments:

当前仓库存在以下 保护分支 :

Protected Branch Version Release
master 0.49.0 1
openEuler-24.03-LTS-Next 0.46.0 1
openEuler-24.03-LTS-SP1 0.46.0 1
openEuler-24.03-LTS-SP3 0.46.0 1
openEuler-24.03-LTS-SP4 0.46.0 1
openEuler-22.03-LTS-SP4 0.27.0 1

评论 /sync <branch1> <branch2> ... 可将当前 PR 修改同步到其它分支(创建同步 PR):
a) 如果当前 PR 是 Open 状态,同步操作将延迟到 PR 被合并时执行
b) 如果当前 PR 已经 Merged,将立即执行同步操作

注意:

  1. /sync 命令可以指定同步到多个分支,仅最后一个 /sync 命令生效
  2. 如果创建的同步 PR 不正确,可通过向同步 PR 的源分支提交轻量级 PR 完善,或使用 /close 命令关闭
likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Added label: stat/needs-squash
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Added label: openeuler-cla/yes
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 10 Comments:

门禁正在运行, 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决,可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/cpp-httplib/77/console

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Added label: ci_processing
jixiang
jixiang
Jul 10 Comments:

/check-cla

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Removed label: openeuler-cla/yes
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Added label: openeuler-cla/yes
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 10 Comments:

aarch64架构构建及构建后检查:multiarch/src-openeuler/aarch64/cpp-httplib/77/console

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 10 Comments:

x86_64架构构建及构建后检查:multiarch/src-openeuler/x86-64/cpp-httplib/77/console

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Removed label: ci_processing
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 10 Comments:
Check Name Build Result 详情 Build Details
check_binary_file ✅SUCCESS #77
check_lfsconfig ☑️EXCLUDE
check_package_yaml_file ✅SUCCESS
check_repo_in_maintain ✅SUCCESS
check_consistency ✅SUCCESS
check_spec_file ✅SUCCESS
x86_64 check_build ✅SUCCESS #77
check_install ✅SUCCESS
check_license ✅SUCCESS
aarch64 check_build ✅SUCCESS #77
check_install ✅SUCCESS
check_license ✅SUCCESS
likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 10 Added label: ci_successful
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 10 Comments:

如下为接口变更检查结果,目标分支为openEuler-22.03-LTS-SP4,请PR提交者check差异信息

Arch Name Check Items Rpm Name Check Result Build Details
compare_package(x86_64) add_rpms ✅SUCCESS #77
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_symbol ✅SUCCESS
compare_package(aarch64) add_rpms ✅SUCCESS #77
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_symbol ✅SUCCESS
likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 10 Comments:
jixiang
jixiang
Jul 12 Comments:

/retest

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 12 Comments:

门禁正在运行, 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决,可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/cpp-httplib/78/console

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 12 Removed label: ci_successful
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 12 Added label: ci_processing
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 12 Comments:

x86_64架构构建及构建后检查:multiarch/src-openeuler/x86-64/cpp-httplib/78/console

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 12 Comments:

aarch64架构构建及构建后检查:multiarch/src-openeuler/aarch64/cpp-httplib/78/console

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 12 Removed label: ci_processing
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 12 Comments:
Check Name Build Result 详情 Build Details
check_binary_file ✅SUCCESS #78
check_lfsconfig ☑️EXCLUDE
check_package_yaml_file ✅SUCCESS
check_repo_in_maintain ✅SUCCESS
check_consistency ✅SUCCESS
check_spec_file ✅SUCCESS
x86_64 check_build ✅SUCCESS #78
check_install ✅SUCCESS
check_license ✅SUCCESS
aarch64 check_build ❌FAILED #78
likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 12 Added label: ci_failed
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 12 Comments:
jixiang
jixiang
Jul 13 Comments:

/ci_mistake 78 infra check_build

likedislike
jixiangjixiang
Jul 13 Pre merge succeeded (commit_id: 41a6832292c16588c051377d142d19ba16710b47)
jixiangjixiang
Jul 13 Force-pushed 1 commits:a5f64141-Fix CVE-2026-45372 in cpp-httplib for 22.03 SP4
jixiangjixiang
Jul 13 Pre merge succeeded (commit_id: 1db81b608aab91a634bfa7e37c3f9804c9513712)
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 13 Removed label: openeuler-cla/yes
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 13 Removed label: stat/needs-squash
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 13 Comments:

Notification

This pull request has been changed(code update) or closed, so removes the following label(s): stat/needs-squash.

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 13 Added label: openeuler-cla/yes
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 13 Comments:

CLA Signature Pass

gca_u2301_82052726, thanks for your pull request. All authors of the commits have signed the CLA. 👍

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 13 Comments:

门禁正在运行, 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决,可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/cpp-httplib/79/console

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 13 Removed label: ci_failed
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 13 Added label: ci_processing
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 13 Comments:

aarch64架构构建及构建后检查:multiarch/src-openeuler/aarch64/cpp-httplib/79/console

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 13 Comments:

x86_64架构构建及构建后检查:multiarch/src-openeuler/x86-64/cpp-httplib/79/console

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 13 Removed label: ci_processing
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 13 Comments:
Check Name Build Result 详情 Build Details
check_binary_file ✅SUCCESS #79
check_lfsconfig ☑️EXCLUDE
check_package_yaml_file ✅SUCCESS
check_repo_in_maintain ✅SUCCESS
check_consistency ✅SUCCESS
check_spec_file ✅SUCCESS
x86_64 check_build ✅SUCCESS #79
check_install ✅SUCCESS
check_license ✅SUCCESS
aarch64 check_build ✅SUCCESS #79
check_install ✅SUCCESS
check_license ✅SUCCESS
likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Jul 13 Added label: ci_successful
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 13 Comments:

如下为接口变更检查结果,目标分支为openEuler-22.03-LTS-SP4,请PR提交者check差异信息

Arch Name Check Items Rpm Name Check Result Build Details
compare_package(x86_64) add_rpms ✅SUCCESS #79
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_symbol ✅SUCCESS
compare_package(aarch64) add_rpms ✅SUCCESS #79
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_symbol ✅SUCCESS
likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Jul 13 Comments:
wk333CollaboratorsJul 13Start code review1
CVE-2026-45372-no-percent-decode-headers.patch
@@ -0,0 +1,3 @@
1+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+From: Ji Xiang <qfmy_250803@qq.com>
3+Date: Fri, 10 Jul 2026 17:20:00 +0800
4+Subject: [PATCH] Fix CVE-2026-45372
wk333Jul 13Comments:

This code comment section is from+1To+4

非原创补丁需要保持补丁头与上游一致 https://github.com/yhirose/cpp-httplib/commit/fbb031ed8504a0e48d9ca63caecc0614c296f755.patch

如何确认该补丁为 CVE 修复补丁,是否有根据 poc 验证 https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m

likedislike