Loading story…
A critical vulnerability, tracked as CVE-2025-66570, has been discovered in cpp-httplib, a widely used single-header C++ HTTP/HTTPS library. The flaw allows attackers to supply reserved HTTP header names such as REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, and LOCAL_PORT in client requests, which are then incorrectly processed by affected versions of the library (≤ 0.26.0). This enables malicious actors to override server-side connection metadata, potentially misleading application logic that depends on these fields for authorization, logging, or network trust decisions.
The vulnerability is particularly severe because cpp-httplib is often embedded transitively in various projects, sometimes without developers' awareness. The issue has been addressed in version 0.27.0, and users are advised to search their codebases for direct or vendored copies of httplib.h to determine exposure. Applications that rely on the affected header values for security-sensitive operations are at heightened risk and should update to the patched version immediately.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Public references describing CVE-2025-66570 and its impact on cpp-httplib were published, highlighting risks to authorization, logging, and trust decisions in affected applications. The disclosure also noted the library's broad use, including transitive inclusion in other projects.
The issue was fixed in cpp-httplib version 0.27.0 by preventing clients from supplying reserved internal header names. Guidance accompanying the fix advised users to upgrade and avoid relying on get_header_value() for sensitive metadata decisions.
A critical vulnerability, CVE-2025-66570, was identified in cpp-httplib versions 0.26.0 and earlier. The flaw allows client-supplied reserved headers such as REMOTE_ADDR and LOCAL_PORT to override server-injected metadata, enabling spoofing of connection details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **libssh2** have exposed SSH clients and products that embed the library to attacks from malicious or impersonated SSH servers. The most severe issue, **`CVE-2026-55200`**, is a pre-authentication out-of-bounds heap write in `ssh2_transport_read()` that affects all versions through **1.11.1** and could allow remote code execution, while **`CVE-2026-55199`** can force clients into a CPU-intensive loop during key exchange and cause denial of service. The library is widely used in **curl**, backup software, IoT firmware, and network appliances, raising broad supply-chain risk, especially where libssh2 is statically linked or bundled into downstream products. A separate flaw, **`CVE-2025-15661`**, affects `sftp_symlink()` in `src/sftp.c` and can be triggered during SFTP `READLINK` or `REALPATH` operations when a malicious server or man-in-the-middle sends a crafted `SSH_FXP_NAME` response with an oversized `link_len` value. That bug causes a heap buffer over-read that may disclose memory contents or crash applications. Fixes were reported in commits **`97acf3d`**, **`1762685`**, and **`2dae302`**, but at the time of reporting no official libssh2 release containing the newer patches had been published, leaving downstream vendors responsible for shipping their own updates.
Jul 12, 2026
Microsoft patched **`CVE-2026-47291`**, a remotely exploitable flaw in **Windows `HTTP.sys`** that can cause denial of service or potentially **kernel-level remote code execution** on systems using the HTTP protocol stack behind IIS and other applications. The bug stems from an **integer overflow** while `HTTP.sys` expands a per-request buffer reference array during **HTTP/1.x header parsing over TLS**; the array's 16-bit capacity can wrap to zero, leading to a large **kernel pool heap buffer overflow** during memory movement operations. Exploitation requires a remote, unauthenticated attacker to send a specially crafted **HTTPS** request with many header lines, placing each header in a separate **TLS application data record** so each becomes a distinct buffer reference. The issue is described as reachable only on the **HTTP/1.x over TLS** path, not the HTTP/2 or HTTP/3 parser paths, and it depends on the target accepting an unusually large request; keeping the **`MaxRequestBytes`** registry setting at or below **65,535 bytes** is cited as a practical mitigation, while applying Microsoft's June 2026 patch is the recommended fix. Detection guidance includes inspecting decrypted HTTPS traffic for excessive HTTP/1.x header lines or, without decryption, looking for sustained connections carrying many small TLS application data records.
Jul 11, 2026
Two newly disclosed vulnerabilities affect **HAProxy through version 3.4.0**, including **`CVE-2026-55203`**, a critical integer overflow in FastCGI handling that can be triggered by a malicious FastCGI backend. The bug resides in the `fcgi_conn` structure’s `drl` field: when `contentLength` is `65535` and `paddingLength` is `1` or greater, the value wraps to `0`, causing the parser to treat buffered data as new FastCGI record headers. That desynchronization can lead to request routing errors, **response smuggling**, and possible memory-safety impacts. The issue is described as remotely exploitable and was fixed in commit `5985276`. A second flaw, **`CVE-2026-55204`**, is a high-severity **NULL pointer dereference** in `hpack_dht_insert()` within `src/hpack-tbl.c`. The vulnerability occurs when HAProxy fails to validate the return value of `hpack_dht_defrag()` after memory-pool exhaustion, allowing a remote attacker to trigger HPACK dynamic table insertions under memory pressure and crash HAProxy worker processes, resulting in denial of service. The bug is fixed in commit `9a6d1fe`, and affected organizations should update HAProxy to a release containing both fixes.
Jun 29, 2026