Control: tags 1151203 + fixed-upstream Control: tags 1145976 + fixed-upstream Control: tags 1145977 + fixed-upstream
Hi, The fix commits from the security tracker, all touching httplib.h only (plus test/test.cc): #1145977 CVE-2026-77358 2f986fd5e56e "Fix use-after-free of TLS session in WebSocketClient::shutdown_and_close()" (v0.50.1+) #1145976 CVE-2026-77341 568d434e72fc "Fix CRLF injection in chunked response trailers" (v0.50.0+) #1151203 CVE-2026-103930 255c075b82cf "Reject CR/LF in the request target and fail the request cleanly (#2501)" (v0.51.0+) unstable 0.41.0+ds-3: applying all three in that order to httplib.h from https://www.google.com/url?q=http://sources.debian.org&source=gmail&ust=1793800251483000&sa=E works, with line offsets only (no fuzz): 2f986fd5 -292/-288, 568d434e -175, 255c075b -213/-524 trixie 0.18.7-1+deb13u1: 568d434e applies (offset -2967); 2f986fd5 and 255c075b do not apply and would need backports. 0.18.7 may not even have the WebSocket client that 2f986fd5 fixes; I have not checked. Mechanical patch-applies check only; not built or tested. Regards
