An update that solves one vulnerability can now be installed.. # Security update for openCryptoki Announcement ID: SUSE-SU-2026:1723-1 Release Date: 2026-05-06T14:57:31Z Rating: moderate References: * bsc#1263819 Cross-References: * CVE-2026-40253 CVSS scores: * CVE-2026-40253 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-40253 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H * CVE-2026-40253 ( NVD ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H * CVE-2026-40253 ( NVD ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise Micro 5.5 An update that solves one vulnerability can now be installed. ## Description: This update for openCryptoki fixes the following issues: * CVE-2026-40253: updated fix by IBM for malformed BER-encoded cryptographic objects (bsc#1263819) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2026-1723=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2026-1723=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * openCryptoki-devel-debuginfo-3.23.0-150500.3.18.1 * openCryptoki-3.23.0-150500.3.18.1 * openCryptoki-debuginfo-3.23.0-150500.3.18.1 * openCryptoki-debugsource-3.23.0-150500.3.18.1 * openCryptoki-devel-3.23.0-150500.3.18.1 * openSUSE Leap 15.5 (i586) * openCryptoki-32bit-debuginfo-3.23.0-150500.3.18.1 * openCryptoki-32bit-3.23.0-150500.3.18.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * openCryptoki-64bit-3.23.0-150500.3.18.1 * openCryptoki-64bit-debuginfo-3.23.0-150500.3.18.1 * SUSE Linux Enterprise Micro 5.5 (s390x) * openCryptoki-debuginfo-3.23.0-150500.3.18.1 *openCryptoki-3.23.0-150500.3.18.1 * openCryptoki-debugsource-3.23.0-150500.3.18.1 ## References: * https://www.suse.com/security/cve/CVE-2026-40253.html * https://bugzilla.suse.com/show_bug.cgi?id=1263819 . An update for openCryptoki addresses a moderate threat of malformed cryptographic objects in SUSE Linux distributions.. openCryptoki update, openSUSE patch, SUSE security advisory. . LinuxSecurity.com Team
Update to 0.37.1 (rbhz#2445943) Fixes Denial of Service via malformed Content-Length header (CVE-2026-31870 Reenables 32-bit build Update to 0.37.0 (rhbz#2441656). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-6ed9c65eaf 2026-03-21 01:09:55.393257+00:00 -------------------------------------------------------------------------------- Name : cpp-httplib Product : Fedora 42 Version : 0.37.1 Release : 2.fc42 URL : httplib Summary : A C++11 single-file header-only cross platform HTTP/HTTPS library Description : A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include the httplib.h file in your code! -------------------------------------------------------------------------------- Update Information: Update to 0.37.1 (rbhz#2445943) Fixes Denial of Service via malformed Content-Length header (CVE-2026-31870 Reenables 32-bit build Update to 0.37.0 (rhbz#2441656) Fixes Denial of Service via crafted HTTP POST request (CVE-2026-29076, rhbz#2445663) Update to 0.35.0 Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies (CVE-2026-28435, rhbz#2444638) Default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVE-2026-28434, rhbz#2444636) httplib/compare/v0.32.0...v0.37.0 -------------------------------------------------------------------------------- ChangeLog: * Thu Mar 12 2026 Petr Men\u0161k - 0.37.1-2 - Build for 32 bits again * Thu Mar 12 2026 Petr Men\u0161k - 0.37.1-1 - Update to 0.37.1 (rhbz#2445943) - Fixes Denial of Service via malformed Content-Length header (CVE-2026-31870) - httplib/security/advisories/GHSA-39q5-hh6x-jpxx - httplib/releases/tag/v0.37.1 * Mon Mar 9 2026 Petr Men\u0161k - 0.37.0-1 - Update to 0.37.0 (rhbz#2441656) - Fixes Denial of Service via crafted HTTP POST request(CVE-2026-29076) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2441656 - cpp-httplib-0.37.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2441656 [ 2 ] Bug #2444636 - CVE-2026-28434 cpp-httplib: default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2444636 [ 3 ] Bug #2444638 - CVE-2026-28435 cpp-httplib: payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2444638 [ 4 ] Bug #2445663 - CVE-2026-29076 cpp-httplib: cpp-httplib: Denial of Service via crafted HTTP POST request [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2445663 [ 5 ] Bug #2445943 - cpp-httplib-0.37.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2445943 [ 6 ] Bug #2446926 - CVE-2026-31870 cpp-httplib: cpp-httplib: Denial of Service via malformed Content-Length header [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2446926 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-6ed9c65eaf' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Update to cpp-httplib 0.37.1 for Fedora 42 fixes DoS risk via malformed headers, improving security and stability.. cpp-httplib security update Fedora 42 DoS. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.