[Buildroot] [PATCH] package/libhttpserver: bump to version 2.0.1

[Buildroot] [PATCH] package/libhttpserver: bump to version 2.0.1

[Stephan Hoffmann]

Version 2.0.1 fixes an unauthenticated remote denial of service in
version 2.0.0. A single multipart/form-data request containing a file
part without a name attribute can terminate the server process. The
issue is rated high severity with a CVSS 3.1 score of 7.5.

The release also replaces the blocking-start pthread mutex and condition
variable with C++20 atomic wait and notify operations. The existing C++20,
GCC 11 and threads requirements cover this change.

https://github.com/etr/libhttpserver/releases/tag/2.0.1
https://github.com/etr/libhttpserver/security/advisories/GHSA-q8g6-h8wv-pr43

Signed-off-by: Stephan Hoffmann <sho@relinux.de>
---
 package/libhttpserver/libhttpserver.hash | 2 +-
 package/libhttpserver/libhttpserver.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/libhttpserver/libhttpserver.hash b/package/libhttpserver/libhttpserver.hash
index b6b1987464..f4f5263362 100644
--- a/package/libhttpserver/libhttpserver.hash
+++ b/package/libhttpserver/libhttpserver.hash
@@ -1,3 +1,3 @@
 # Locally computed:
-sha256  c44d67aba1e4b6767c0fbb895e1acd643601c1e3ee3de7705a59ed09bcd8c92e  libhttpserver-2.0.0.tar.gz
+sha256  cd6a53302415143abff2db2b92e59d3de837652243717c873d4fb41fe22fbb70  libhttpserver-2.0.1.tar.gz
 sha256  5df07007198989c622f5d41de8d703e7bef3d0e79d62e24332ee739a452af62a  COPYING.LESSER
diff --git a/package/libhttpserver/libhttpserver.mk b/package/libhttpserver/libhttpserver.mk
index 7b7aedef0d..535c237f5d 100644
--- a/package/libhttpserver/libhttpserver.mk
+++ b/package/libhttpserver/libhttpserver.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBHTTPSERVER_VERSION = 2.0.0
+LIBHTTPSERVER_VERSION = 2.0.1
 LIBHTTPSERVER_SITE = $(call github,etr,libhttpserver,$(LIBHTTPSERVER_VERSION))
 LIBHTTPSERVER_LICENSE = LGPL-2.1+
 LIBHTTPSERVER_LICENSE_FILES = COPYING.LESSER
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libhttpserver: bump to version 2.0.1

[Thomas Petazzoni via buildroot]

On Mon, Oct 19, 2026 at 02:17:26PM +0200, Stephan Hoffmann wrote:
> Version 2.0.1 fixes an unauthenticated remote denial of service in
> version 2.0.0. A single multipart/form-data request containing a file
> part without a name attribute can terminate the server process. The
> issue is rated high severity with a CVSS 3.1 score of 7.5.
> 
> The release also replaces the blocking-start pthread mutex and condition
> variable with C++20 atomic wait and notify operations. The existing C++20,
> GCC 11 and threads requirements cover this change.
> 
> https://github.com/etr/libhttpserver/releases/tag/2.0.1
> https://github.com/etr/libhttpserver/security/advisories/GHSA-q8g6-h8wv-pr43
> 
> Signed-off-by: Stephan Hoffmann <sho@relinux.de>

Since it's clearly a security related bump, I've updated the commit
title to "security bump to version 2.0.1" and applied to
master. Thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot