Multiple Libraries Face JSON and Buffer Handling Vulnerabilities

The Yhirose cpp-httplib library, a single-file header-only HTTP/HTTPS library, has a vulnerability in its Mbed TLS and wolfSSL backends. Versions 0.31.0 through 0.46.1 for Mbed TLS and 0.33.0 through 0.46.1 for wolfSSL are affected. The issue arises from improper handling of non-finite floating-point values during JSON serialization when using the MapMessage feature, leading to invalid JSON output. This could potentially be exploited by an attacker to cause denial-of-service or other unintended behavior by sending specially crafted data that results in malformed JSON. Users should update to patched versions to mitigate this risk. CVE-2026-49844 impacts Apache Log4j API versions 2.13.1 through 2.26.0.

The h2o HTTP server, which supports HTTP/1.x, HTTP/2, and HTTP/3, has a vulnerability related to QPACK instruction processing over HTTP/3. In versions prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, lib/http3/qpack.c could allocate an on-stack buffer that might be too small to handle certain QPACK instructions from a peer. This could lead to a stack buffer overflow, potentially causing a denial-of-service or allowing for arbitrary code execution under certain conditions. Users of h2o should ensure they are using a version that includes the fix for this issue. CVE-2026-55213 affects h2o prior to the specified commit.