Stay Secure with the Latest Linux Advisories

security advisorycriticalip-spoofing

openSUSE: cpp-httplib Exposed to IP Spoofing Log Pollution CVE-2026:20056-1

An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.. openSUSE security update: security update for cpp-httplib ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20056-1 Rating: critical References: * bsc#1254734 * bsc#1254735 Cross-References: * CVE-2025-66570 * CVE-2025-66577 CVSS scores: * CVE-2025-66570 ( SUSE ): 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N * CVE-2025-66570 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-66577 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2025-66577 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed. Description: This update for cpp-httplib fixes the following issues: - CVE-2025-66570: IP spoofing, log poisoning, and authorization bypass via header shadowing due to acceptance and parsing of client-controlled injected HTTP headers in incoming requests (bsc#1254734). - CVE-2025-66577: access and error log poisoning with spoofed client IPs due to unconditional acceptance of client-controlled `X-Forwarded-For` and `X-Real-IP` headers (bsc#1254735). Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-150=1 Package List: - openSUSE Leap 16.0: cpp-httplib-devel-0.22.0-160000.3.1 libcpp-httplib0_22-0.22.0-160000.3.1 References: * https://www.suse.com/security/cve/CVE-2025-66570.html * https://www.suse.com/security/cve/CVE-2025-66577.html . Critical security update for openSUSE addressing IP spoofing and log poisoning in cpp-httplib. Patchrequired.. openSUSE security, cpp-httplib update, critical vulnerabilities, IP spoofing, log poisoning. . Severity: Critical. LinuxSecurity.com Team

Jan 18, 2026 •Critical OpenSUSE