{
  "cveId": "CVE-2026-46527",
  "url": "https://patchblox.com/security/cve/CVE-2026-46527",
  "summary": "CVE-2026-46527 is fixed in 2 products on 1 platform, first by FEDORA-2026-1D4BD0354A, released June 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "cpp-httplib: # Update to 0.48.0 (rhbz#2481109)\n\n## Security fixes\n\n- Complete the IP-host certificate identity fix from v0.47.0 fo...",
  "description": "# Update to 0.48.0 (rhbz#2481109)\n\n## Security fixes\n\n- Complete the IP-host certificate identity fix from v0.47.0 for the\nMbed TLS and wolfSSL backends. An IP-literal host is now authenticated\nonly via a matching iPAddress SAN, never via the certificate\u0027s Common\nName (RFC 9110) \u2014 matching what the OpenSSL backend already enforces\nthrough X509_check_ip. Previously these backends fell back to the CN\nwhen no IP SAN matched, and recognized IPv4 only; now IPv6 (16-byte)\niPAddress SANs are matched as well, and the CN fallback is skipped for\nboth IPv4 and IPv6 literal hosts (#2476)\n\n## Improvements\n\n- Replace the strtod-based from_chars for double with a hand-written,\nlocale-independent parser. The only double parsed by the library is the\nHTTP quality value; strtod reads the decimal separator from the global C\nlocale, so an embedder calling setlocale(LC_ALL, \u0022\u0022) into a\ncomma-decimal locale would mis-parse q-values. The new parser always\ntreats . as the decimal separator and is allocation-free (Fix #2475)\n- Fix OpenSSL 4.0 deprecation warnings: fetch CA store objects via the\nthread-safe X509_STORE_get1_objects() (OpenSSL 3.3\u002B) and extract the\nsubject CN via X509_NAME_get_index_by_NID()/X509_NAME_get_entry()\ninstead of the deprecated X509_STORE_get0_objects() and\nX509_NAME_get_text_by_NID(). Older OpenSSL, BoringSSL, and LibreSSL keep\nusing the get0 path. Verified warning-free against OpenSSL 4.0.1, 3.6.2,\nand 3.0\n\n## Behavior changes\n\n- decode_query_component() now uses strict hex parsing for\npercent-escapes, consistent with decode_uri_component() and\ndecode_path_component(). A % followed by non-hex characters (e.g. a sign\nor whitespace such as %-1, %\u002B5, % 5) is passed through literally instead\nof being accepted as a valid escape (#2472)\n\nSource: https://github.com/yhirose/cpp-httplib/releases/tag/v0.48.0\n\n# Update to 0.47.0 (rhbz#2481109, CVE-2026-46527, CVE-2026-45372, CVE-2026-45352)\n\n## Security fixes\n\n- Fix TLS certificate chain verification bypass for IP-literal hosts on the Mbed TLS and wolfSSL backends: with server certificate verification enabled, SSLClient skipped chain validation entirely (any untrusted certificate with a matching IP SAN was accepted), and WebSocketClient on Mbed TLS skipped verification altogether. Chain verification now stays enabled for IP hosts, and certificate identity is verified post-handshake against IP SANs on all backends. SNI is no longer sent for IP hosts on Mbed TLS and wolfSSL, per RFC 6066 ([CVE-2026-54919](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8ffh-4p95-g3p2))\n\n## New features\n\n- Add Server::set_start_handler(): a callback invoked when the server is ready to accept connections, useful when running the server in a background thread (#2467)\n- Add Client/SSLClient/WebSocketClient::enable_system_ca(bool) to opt into loading system CA certificates alongside a custom CA. The default is unchanged: a custom CA remains exclusive. The setting carries over to clients created for HTTPS redirects (#2471)\n- Add WebSocketClient::set_hostname_addr_map() to connect to a specific IP address while keeping the original hostname for the handshake and certificate verification (#2463)\n\n## Behavior changes\n\n- The request body is now read after route matching and the pre-request handler, so both the regular handler and ContentReader paths behave the same: route matching \u2192 pre-request handler \u2192 body read \u2192 handler. A request rejected by the pre-request handler (e.g. failed per-route authentication via req.matched_route) no longer buffers the body at all. Note: code that referenced req.body or body-derived form fields inside the pre-request handler will now see an empty body; inspect headers, path, query parameters, or matched_route instead\n- WebSocketClient with a custom CA no longer merges system CA certificates (it previously always merged them). This matches SSLClient behavior; call enable_system_ca(true) to load system CA certificates alongside the custom CA\n- Range request headers are now ignored for streaming responses of unknown length instead of producing an invalid response (#2465)\n\n## Bug fixes\n\n- Fix SSLClient::set_ca_cert_store() breaking custom-CA exclusivity: system CA certificates were silently merged into the user-provided store, broadening the trust set. Also fix Client::load_ca_cert_store() not carrying CA certificates over to clients created for HTTPS redirects\n- Fix WebSocketClient dropping the query string from the URL during the upgrade handshake, so query parameters (e.g. auth tokens) are sent (#2468)\n- Fix a use-after-free when reconnecting a WebSocketClient after set_ca_cert_store(), and a memory leak in the Mbed TLS and wolfSSL set_ca_cert_store() backends\n- Fix MSVC warning C4309 (truncation of constant value) in SHA padding code (#2464)\n- Cast to unsigned char before ctype calls in is_hex and is_token_char to avoid undefined behavior with negative char values (#2469)\n\nSource: https://github.com/yhirose/cpp-httplib/releases/tag/v0.47.0",
  "published": "2026-06-24T13:16:30Z",
  "severity": "important",
  "epss": 0.00327,
  "epssPercentile": 0.2603,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "cpp-httplib",
      "release": "Fedora 43",
      "fixedVersion": "0.48.0-1.fc43",
      "fix": "FEDORA-2026-1D4BD0354A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-1d4bd0354a",
      "released": "2026-06-24T13:16:30Z"
    },
    {
      "platform": "linux",
      "product": "cpp-httplib-devel",
      "release": "Fedora 43",
      "fixedVersion": "0.48.0-1.fc43",
      "fix": "FEDORA-2026-1D4BD0354A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-1d4bd0354a",
      "released": "2026-06-24T13:16:30Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}