Hallo Alex,
Yes, we indeed forgot to tag v1.0.5. I've fixed that now.
As for announcements, yeah, I got a bit too busy making releases ;-).
Will try to do much better in the future. And no, we don't have any
other good way for you to be notified, if nobody writes a release
announcement, well, then there isn't one. Which is not good, I
understand. As I said, we'll try to do better ;-).
Cheers!
Christian
On 8/13/26 8:34 AM, Alexander Dahl wrote:
Hello Christian,
while reviewing changes between v1.0.5 and the recent v1.0.10
I noticed there's no git tag for v1.0.5 in the source repository.
Maybe that was just forgotten?
The other thing is: there were no announcements for versions v1.0.6 to
v1.0.10 published on this mailing list nor on that generic gnu
announce list. Will there be announcements for future versions or is
there any other mechanism we can follow to get notified of new
releases?
Thanks and greets
Alex
Am Thu, Apr 16, 2026 at 10:43:34AM +0200 schrieb Christian Grothoff via
libmicrohttpd:
Dear all,
We are happy to announce the release of GNU libmicrohttpd 1.0.5.
This release mostly fixes a minor HTTP request header smuggling
vulnerability discovered by SySS [1] where MHD ignores the existence of
duplicate headers (such as "Content-Length") instead of rejecting the
HTTP request as per RFCs.
[1]
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-018.txt
About GNU libmicrohttpd
=======================
GNU libmicrohttpd is a small C library that makes it easy to run an
HTTP server as part of another application. GNU Libmicrohttpd is free
software and an official GNU package. Key features that distinguish
GNU libmicrohttpd from other projects are:
* C library: fast and small
* API is expressive and fully reentrant
* Implementation is HTTP 1.1 compliant
* HTTP server can listen on multiple ports
* Various threading modes
* Three different sockets polling modes
* Broad platform support
* Support for IPv4 and IPv6
* Support for incremental processing of POST data
* Support for basic and digest authentication
* Support for TLS (requires libgnutls)
Do not use GNU libmicrohttpd if you are looking for a standalone HTTP
server, there are many other projects out there that provide that kind
of functionality already. However, if you want to be able to serve
HTTP requests from within your C or C++ application, check it out!
GNU libmicrohttpd has been primarily developed by the GNU maintainers
Evgeny Grin and Christian Grothoff over the last 20 years with the
help of a large community contributing features, bug reports and bug
fixes.
Changes
=======
This release fixes the HTTP header parsing logic to make sure certain HTTP
headers are unique, rejecting malformed requests outright instead
of exposing applications to them.
Download
========
You can download GNU libmicrohttpd from:
* https://ftp.gnu.org/gnu/libmicrohttpd/ and all GNU FTP mirrors.
* Our Git repository at git://git.gnunet.org/libmicrohttpd.git
Please report bugs to our bugtracker at
https://bugs.gnunet.org/set_project.php?project_id=10.
The documentation (including a reference manual and tutorial) can be
found at https://gnu.org/s/libmicrohttpd.
Happy hacking!
Evgeny & Christian
