NEWS (19194B)
1 Fri Aug 7 10:15:01 PM CEST 2026 2 Released GNU libmicrohttpd 1.0.10. 3 4 This is a bugfix release, fixing minor bugs 5 and expanding the test suite. 6 7 -- Christian Grothoff 8 9 Thu Jul 30 05:34:18 PM CEST 2026 10 Released GNU libmicrohttpd 1.0.9. 11 12 This is a bugfix release, fixing minor vulnerabilities 13 and expanding the test suite. 14 15 -- Christian Grothoff 16 17 Tue Jul 28 06:13:26 PM CEST 2026 18 Released GNU libmicrohttpd 1.0.8. 19 20 This is a bugfix release, fixing minor security vulnerabilities 21 and expanding the test suite. 22 23 -- Christian Grothoff 24 25 Mon Jul 27 06:13:26 PM CEST 2026 26 Released GNU libmicrohttpd 1.0.7. 27 28 This is a bugfix release, fixing modest security vulnerabilities 29 discovered by A. Ramos. 30 31 -- Christian Grothoff 32 33 Wed Jul 8 12:47:35 PM CEST 2026 34 Released GNU libmicrohttpd 1.0.6. 35 36 This is a bugfix release, fixing minor bugs mostly in error handling, 37 theoretical integer overflows, and rare memory leaks. 38 39 -- Christian Grothoff 40 41 Thu Apr 16 10:36:54 AM CEST 2026 42 Released GNU libmicrohttpd 1.0.5. 43 44 This is a bugfix release. 45 It fixes a additional HTTP request smuggling issues (CWE-444). 46 47 -- Christian Grothoff 48 49 Mon Apr 13 11:42:06 AM CEST 2026 50 Released GNU libmicrohttpd 1.0.4. 51 52 This is a bugfix release. 53 It fixes a minor HTTP request smuggling issue (CWE-444). 54 55 -- Christian Grothoff 56 57 Thu Apr 2 12:16:28 AM CEST 2026 58 Released GNU libmicrohttpd 1.0.3. 59 60 This is a bugfix release. 61 It primarily fixes a list traversal issue that could 62 cause connection handling issues when other connections 63 were suspended. 64 65 -- Christian Grothoff 66 67 Mon Jul 14 2025 05:03:07 PM CEST 68 Released GNU libmicrohttpd 1.0.2. 69 70 This is a bugfix release. 71 It primarily fixes a double-close() bug on bind() errors. 72 73 -- Christian Grothoff 74 75 Fri 23 Feb 2024 21:00:00 UZT 76 Released GNU libmicrohttpd 1.0.1. 77 78 This is a correction release. 79 This release mainly fixes and improves builds with non-default configure 80 parameters. 81 82 -- Evgeny Grin (Karlson2k) 83 84 Thu 01 Feb 2024 15:00:00 CET 85 Released GNU libmicrohttpd 1.0.0. 86 87 This is the first non-bugfix release since version 0.9.75 and the first 88 ever stable release of GNU libmicrohttpd. It is a huge one with new 89 features and fixes. 90 91 The major changes: 92 * Rewritten parsing of clients' requests, fully aligned with current 93 RFCs (9110 and 9112) requirements. Added detailed control of strict 94 or lenient specification enforcement. Application may choose between 95 more compatible mode or more strict and secure mode. 96 * Reworked Digest Auth, greater enhanced support for current RFC 7617 97 features. MHD currently is the only known server-side implementation 98 with support for SHA-512/256, userhash and username in extended 99 notation. At the same time the very old RFC2069 is supported, as 100 well as MD5 and SHA-256. 101 * Improved functionality in multi-threading environment, especially with 102 external sockets polling modes. 103 * Reworked Basic Auth, adding new convenient API functions. 104 * Re-implemented GnuTLS initialisation. Now supported 105 libmicrohttpd-specific system-wide configuration, as well as generic 106 GnuTLS system-wide configuration. Application may adjust settings based 107 on system configuration instead of specifying its own full 108 configuration. 109 * Tons of other new functionality and various fixes. For detailed changes 110 see the ChangeLog or Git commit logs. 111 112 113 Since last non-bugfix release there are 1062 commits added with 114 67007 lines insertions and 26616 deletions. 115 116 -- Evgeny Grin (Karlson2k) 117 118 Sun 28 May 2023 18:00:00 MSK 119 Released GNU libmicrohttpd 0.9.77. 120 121 This is mostly a bugfix release. 122 This version created by taking patches from the current development 123 branch and back-porting them on top of version 0.9.76. 124 The most notable changes are: some improvements for Digest and Basic 125 authorizations, fixed efficiency for TLS upgraded connections, fixed 126 processing of folded headers in requests, fixed functionality with 127 blocking sockets, improved and fixed internal test-suite. 128 129 The more detailed list of the important changes: 130 131 API changes: 132 + Added new function MHD_get_version_bin(). 133 134 Improvements and enhancements: 135 * Digest Auth: changed algorithm identifiers in server generated 136 headers from "md5" / "sha-256" to "MD5" / "SHA-256" to better match 137 RFC (while clients should use caseless matching). 138 * Improved Base64 decoding by new implementation with robust input 139 data validation checks. 140 * Improved configure for cross-compiling, for better compatibility 141 with POSIX and for better compatibility with the latest compiler 142 versions. 143 * New internal tests: for Base64 decoding, Basic Auth and folded 144 headers. 145 * Supported new libcurl API in tests to mute deprecation warnings. 146 * Supported ARM and ARM64 for VC compilers. 147 148 Functionality changes: 149 * any negative number returned by response data generation callback 150 function is treated as an error. Previously negative values except 151 predefined error codes could produce undefined behaviour. 152 * Added handling of "DEBUG" preprocessor macro as an alias of "_DEBUG". 153 154 Fixes: 155 # Fixed functionality with blocking sockets. 156 # Fixed very inefficient data pumping for upgraded TLS connections. 157 # Fixed processing of folded headers in the requests. 158 # Fixed data races when closing upgraded connection. 159 # Removed duplication of "Connection: upgrade" header. 160 # Digest auth: fixed thread sync to avoid "stale hash" results. 161 # Fixed harmless unwanted extra data processing resulting in triggering 162 of the assert. 163 # Fixed tests for LTO. 164 # Removed removed non-portable functions in examples. 165 # Fixed delayed call of connection notification callback in 166 thread-per-connection mode. 167 # Fixed Address Sanitizer unpoison of memory when memory pool is 168 destroyed. This fixed periodic ASAN error when used for a long time 169 with the sanitizer. 170 # Fixed compiler warnings in library code, examples, tests and configure 171 checks. 172 # New TLS certificates for test-suite: all with SAN fields and SHA-256 173 hash. 174 # Tests: fixed tests on Darwin 22.x (Ventura). 175 # Tests: redesigned one tests group to avoid stress-testing of the OS. 176 177 -- Evgeny Grin (Karlson2k) 178 179 Sun 26 Feb 2023 17:49:30 CET 180 Released GNU libmicrohttpd 0.9.76 hotfix. -CG 181 182 This is a hotfix release. 183 This only change since previous release is fixed potential DoS vector 184 in MHD_PostProcessor discovered by Gynvael Coldwind and Dejan 185 Alvadzijevic (CVE-2023-27371). 186 While the researchers have not been able to exploit this attack vector 187 when libmicrohttpd is compiled with the standard GNU C library, it is 188 recommended that you update MHD as soon as possible if your 189 applications are using (optional) MHD_PostProcessor functionality. 190 191 -- Evgeny Grin (Karlson2k) 192 193 Sun 26 Dec 2021 20:30:00 MSK 194 Released GNU libmicrohttpd 0.9.75 -EG 195 196 This is a correction release. 197 The main improvement is the implementation of workaround for some 198 OSes (like OpenBSD 7) where "monotonic" clock may jump back. Now 199 MHD is able to automatically detect such situation and recover if 200 the jump is small. This workaround is needed with increased 201 accuracy of connection timeout introduced in previous version, as 202 with lower accuracy (v0.9.73 and before) these jumpbacks were 203 unnoticeable. 204 Other changes: fixed some compiler, Makefile, and configure 205 warnings on specific platforms; one test further improved. 206 207 -- Evgeny Grin (Karlson2k) 208 209 210 Sun 19 Dec 2021 18:30:00 MSK 211 Released GNU libmicrohttpd 0.9.74 212 213 This release brings a lot of fixes and improvements, and 214 important new features. 215 The most significant addition is the new experimental 216 implementation of WebSockets contributed by David Gausmann. This 217 implementation is not fully tested yet so currently it is disabled 218 by default. 219 Other changes include a lot of improvements and clarifications 220 in doxy comments in microhttpd.h header file, improved compliance 221 with the RFC HTTP specifications, the new implementation of reply 222 header forming, the new implementation of request chunked encoding 223 parsing, new automatic error replies, internal optimisations, and 224 many important fixes, including fixes for long-standing bugs. 225 226 More detailed list of notable changes: 227 228 API changes: 229 + Added new function MHD_get_reason_phrase_len_for(). 230 + Added MHD_CONNECTION_INFO_HTTP_STATUS type of information 231 queried by MHD_get_connection_info(). 232 + Added new response flag MHD_RF_SEND_KEEP_ALIVE_HEADER to force 233 sending of "keep-alive" header even if not required by RFC. 234 + Added new response creation function 235 MHD_create_response_from_buffer_with_free_callback_cls() with 236 custom cleanup callback. 237 + Added new response flag MHD_RF_HTTP_1_0_COMPATIBLE_STRICT with 238 the same functionality as existing MHD_RF_HTTP_VERSION_1_0_ONLY 239 flag. The old flag will be deprecated. 240 + Added new response flag MHD_RF_HTTP_1_0_SERVER with the same 241 functionality as existing MHD_RF_HTTP_VERSION_1_0_RESPONSE flag. 242 The old flag will be deprecated. 243 244 New features: 245 + Added experimental WebSockets extension with separate header. 246 Disabled by default as it is not fully tested yet. 247 + Added '--enable-sanitizers[=address,undefined,leak,user-poison]' 248 configure parameter (instead of '--enable-sanitizer'), 249 implemented custom memory poisoning for memory pools. 250 251 Improvements and enhancements: 252 * Doxy function descriptions was corrected, clarified, extended, 253 and improved. Now it should be much easier to learn MHD just by 254 reading the headers. 255 * Completely rewritten reply header forming. New implementation is 256 more robust, simpler maintainable and expandable, and better 257 follows RFC HTTP specifications. 258 * Performance improvements: now HTTP version and request method are 259 decoded one time only (previously MHD used string comparison many 260 times during processing the data). 261 * Rewritten request chunked payload decoding. The new 262 implementation better conforms to the HTTP RFC, detects format 263 problems earlier, replies to the clients with description of 264 detected problems, handles untypical (but syntactically correct) 265 values properly. 266 * Added special replies for wrong/unsupported HTTP versions in 267 requests, broken HTTP chunked encoding in requests, 268 * As required by HTTP RFC, added automatic error replies if client 269 used broken chunked encoding, too large chunk size, too large 270 payload size, or broken Content-Length header. 271 * Optimized connection's memory pool handling. 272 * Changed timeout precision from one second to one millisecond. 273 * Added some checks for incorrect user data, reporting problems in 274 MHD log. 275 * Improved performance of hash calculations functions by using 276 compiler built-ins (if available). 277 * Implemented SHA-1 calculations (required for WebSockets). 278 * Added universal MSVC project that works with any (sufficiently 279 new) version of MSVC. 280 * Developed simple HTTP client to test MHD under very special 281 conditions. 282 * Implemented 45 new tests. 283 * Improved existing tests to test more aspects of MHD. 284 * Added check for correct results of system and libcurl functions. 285 * Response headers are checked during forming of responses. 286 * HTTPS tests were improved. 287 * Added rebuild on W32 of all required files if files are missing. 288 * Many internal optimisations and improvements. 289 290 Functionality changes: 291 * Keep-alive header is omitted by default for HTTP/1.1 connections. 292 Use of header can be enforced by response flag. 293 * Chunked encoding is used for HTTP/1.1 non-keep-alive connections 294 for responses with unknown size. Previously MHD used "indication 295 of the end of the response by closing connection" in such cases, 296 however it is not correct for HTTP/1.1 connections as per HTTP 297 RFC. 298 * As required by HTTP RFC, use HTTP/1.1 version instead of HTTP/1.0 299 in reply headers when client is HTTP/1.0 . HTTP/1.0 version can 300 be enforced by response flag. 301 * User response headers are used in replies in the same order as 302 was added by application. 303 * Allowed tab characters in response header values. 304 * All custom "Connection:" response headers are automatically 305 combined into single "Connection:" header. 306 * "keep-alive" token silently dropped from custom "Connection:" 307 response header. "Keep-alive" cannot be enforced and used 308 automatically if possible. 309 * Allow tab character in custom response header value. 310 * Disallow space character in custom response header value. 311 * Do not allow responses with 1xx codes for HTTP/1.0 requests. 312 * Detected and reported incorrect "Upgrade" responses. 313 * W32 targets are changed to Vista+ by default. XP is supported 314 still. 315 316 Fixes: 317 # Fixed short busy-waiting (up to one second) when connection is 318 going to be expired and closed. 319 # Fixed handling of errors during start of new connection, fixed 320 inability to accept new connections in thread-per-connection mode 321 due to the missing decrement of number of daemon's connections if 322 start of new thread is failed. 323 # Fixed incorrect parsing of LFLF, LFCR, CRCR, and bare CR as 324 single linefeed in request header and request chunked payload. 325 Now only CRLF or bare LF are recognized as linefeed. 326 # Fixed response chunked encoding handling. Now it works properly 327 with non-keep-alive connection, with fixed size replies (if 328 chunked was enforced by header), and in other situations. 329 # Other fixes for chunked replies. 330 # Fixed handling of custom connection timeout in thread-per- 331 connection mode. 332 # Fixed wrongly used MHD_REQUEST_TERMINATED_COMPLETED_OK code for 333 application notification when MHD_REQUEST_TERMINATED_WITH_ERROR 334 code must be used. 335 # Fixed code MHD_REQUEST_TERMINATED_READ_ERROR not reported (code 336 MHD_REQUEST_TERMINATED_WITH_ERROR was incorrectly used instead). 337 # Fixed handling of request chunked encoding with untypical 338 formatting. 339 # Fixed processing of last part of hex-encoded values under 340 certain conditions. 341 # Fixed value returned for MHD_CONNECTION_INFO_REQUEST_HEADER_SIZE. 342 # Fixed returned value for MHD_FEATURE_AUTOSUPPRESS_SIGPIPE on W32, 343 now it is MHD_YES as W32 does not need SIGPIPE suppression. 344 # Fixed portability of bitwise NOT for enums values. 345 # Fixed SHA-256 and MD5 calculations with unaligned data. 346 # Fixed incorrect caseless matching for HTTP version. 347 # Fixed incorrect caseless matching for request method. 348 # Fixed compatibility with old GnuTLS versions. 349 # Fixed compiler warnings on 32-bits platforms. 350 # Fixed blocking sockets setting in tests and examples for W32. 351 # Fixed examples to really use libmagic if present. 352 # HTTPS tests were fixed. 353 # Fixed libcurl test with case-insensitive match for HTTP methods, 354 method names must use case-sensitive match. 355 # Fixed tests compatibility with old libcurl versions. 356 # Fixed build on W32 with llvm-dlltool (this tool is too 357 oversimplified) 358 359 -- Evgeny Grin (Karlson2k) 360 361 362 Sun 25 Apr 2021 14:00:00 MSK 363 Released GNU libmicrohttpd 0.9.73 364 365 This release brings new features, improvements, and a few fixes. 366 The most important addition is the new function for vector-backed 367 responses, based on the patch contributed by NASA engineers. 368 Other changes include compatibility with autoconf 2.70+, improved 369 testsuite compatibility with CI systems, fixed and improved MSVC 370 builds, and implementation of ALPN support. 371 372 More detailed list of notable changes: 373 374 API changes: 375 + Added new function MHD_create_response_from_iovec(), based on the 376 patch provided by Lawrence Sebald and Damon N. Earp from NASA. 377 + Added MHD_OPTION_SIGPIPE_HANDLED_BY_APP daemon option. 378 + Added new function MHD_run_wait(). 379 + Added MHD_OPTION_TLS_NO_ALPN to disable usage of ALPN even if 380 it is supported by TLS library. 381 382 New features: 383 + Added '--enable-heavy-tests' configure parameter (disabled by 384 default). 385 + Implemented support for ALPN. 386 387 Improvements and enhancements: 388 * Return timeout of zero also for connections awaiting cleanup. 389 * Compatibility with autoconf >=2.70, used new autoconf features. 390 * Warn user when custom logger option is not the first option. 391 * Added information to the header about minimal MHD version when 392 particular symbols were introduced. 393 * Updated test certificates to be compatible with modern browsers. 394 * Added on-fly detection of UNIX domain sockets and pipes, MHD does 395 not try to use TCP/IP-specific socket options on them. 396 * Report more detailed error description in the MHD log for send 397 and receive errors. 398 * Enabled bind port autodetection for MSVC builds. 399 400 Fixes: 401 # Fix PostProcessor to always properly stop iteration when 402 application callback tells it to do so. 403 # Fixed MD5 digest authorization broken when compiled without 404 variable length arrays support (notably with MSVC). 405 # Fixed detection of type of send errors on W32. 406 407 -- Evgeny Grin (Karlson2k) 408 409 410 Mon 28 Dec 2020 21:36:00 MSK 411 Released GNU libmicrohttpd 0.9.72 412 413 This release is mostly a bugfix release, with greatly improved 414 compatibility with various OSes/kernels, including FreeBSD, Windows, 415 OpenBSD, NetBSD, Darwin (macOS), Solaris. Performance is improved, 416 especially with HTTPS connections and stay-alive HTTP connections. 417 418 Notable changes since version 0.9.71: 419 420 API changes: 421 + New function MHD_create_response_from_pipe() 422 423 Improvements and enhancements: 424 * Fully rewritten code for buffering/pushing from kernel network buffers 425 for compatibility with various OSes. Reduced number of additional 426 sys-calls, network is better utilized, responses are delivered faster. 427 * Restored optimal sendfile() usage on FreeBSD. 428 * MHD now takes care about SIGPIPE handling by blocking it in internal 429 threads and avoiding functions (like sendfile()) that could generate 430 SIGPIPE when blocking of this signal is not possible. 431 432 Fixes: 433 # Fixed crash in PostProcessor. 434 # Fixed several resources leaks in corner cases. 435 # Improved thread sync, thread safety and fixed one use-after-free under 436 special conditions during stopping of daemon. 437 # Updated HTTP status codes, header names and methods from the 438 registries. 439 # Fixed functioning without listen socket and with internal threads. 440 # Fixed streaming of chunked responses for both HTTP and HTTPS. 441 # Various compatibility fixes. 442 443 -- Evgeny Grin (Karlson2k) 444 445 446 Tue Jan 9 20:52:48 MST 2007 447 Project posted.