What you need to know today.
Low-risk vulnerabilities disclosed in cpp-httplib, Apache Log4j API, and h2o HTTP server could lead to denial-of-service conditions or data integrity issues.
The cpp-httplib C++ header-only HTTP/HTTPS library has a vulnerability in its Mbed TLS and wolfSSL backends that could lead to denial-of-service conditions. Versions 0.31.0 through 0.46.1 with the Mbed TLS backend and 0.33.0 through 0.46.1 with the wolfSSL backend are affected. The issue arises from improper handling of certain data, potentially causing the application to crash or become unresponsive when processing malicious requests. Users are advised to update to patched versions once available. CVE-2026-54919 is associated with this issue.
Apache Log4j API versions 2.13.1 through 2.26.0 are impacted by a flaw in JSON serialization. Specifically, the improper encoding of non-finite floating-point values can result in output that is not valid JSON. This could disrupt logging processes or cause downstream systems that rely on strict JSON formatting to fail. Developers should ensure they are using versions of Log4j API that correctly handle these edge cases in floating-point representations. CVE-2026-49844 details this vulnerability.
A potential denial-of-service vulnerability exists in the h2o HTTP server, specifically within its HTTP/3 implementation when handling QPACK instructions. Versions prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 may allocate excessive on-stack memory when processing these instructions, which could lead to a crash. This affects the server's ability to handle concurrent connections or process specific types of HTTP/3 traffic. Users of h2o should update to a patched version to mitigate this risk. CVE-2026-55213 describes this flaw.