Opening this issue because I went to consume prometheus-cpp as a dependency of opentelemetry-cpp and I'm starting to run into issues flagged by my dependency scanning tools, with CivetWeb, consumed by this library. Several were already logged but I've logged a couple myself to make the maintainers aware.
Specifically the issues that have been flagged thus far are:
CVE-2021-44964: Resolvable by updating Lua to v5.4.4+
CVE-2022-28805: Resolvable by updating Lua to v5.4.4+
CVE-2025-55763: Fix seems to exist based on issue discussion but is as yet unreleased
CVE-2026-5789: As yet unfixed in CivetWeb
CVE-2025-57052: Resolvable by updating cJSON to v1.7.19+ (not an issue with live code -- civetweb uses cJSON in example usage code only as far as I can tell, but it does still trip automated security scans. Included for completeness)
Normally, I'd just write this up for CivetWeb, but unfortunately earlier this year the primary maintainer of that library has made statements that suggest we should not expect fixes on any consistent timeframe. Maintainer’s commentary. Looking at my calendar, I don't expect I will have bandwidth to address the dependency updates myself either.
Writing to ask if the maintainers of this repo were aware of these security issues and whether any thought was given to reconsidering usage of CivetWeb, if a new maintainer is not found for the repo.
Opening this issue because I went to consume prometheus-cpp as a dependency of opentelemetry-cpp and I'm starting to run into issues flagged by my dependency scanning tools, with CivetWeb, consumed by this library. Several were already logged but I've logged a couple myself to make the maintainers aware.
Specifically the issues that have been flagged thus far are:
CVE-2021-44964: Resolvable by updating Lua to v5.4.4+
CVE-2022-28805: Resolvable by updating Lua to v5.4.4+
CVE-2025-55763: Fix seems to exist based on issue discussion but is as yet unreleased
CVE-2026-5789: As yet unfixed in CivetWeb
CVE-2025-57052: Resolvable by updating cJSON to v1.7.19+ (not an issue with live code -- civetweb uses cJSON in example usage code only as far as I can tell, but it does still trip automated security scans. Included for completeness)
Normally, I'd just write this up for CivetWeb, but unfortunately earlier this year the primary maintainer of that library has made statements that suggest we should not expect fixes on any consistent timeframe. Maintainer’s commentary. Looking at my calendar, I don't expect I will have bandwidth to address the dependency updates myself either.
Writing to ask if the maintainers of this repo were aware of these security issues and whether any thought was given to reconsidering usage of CivetWeb, if a new maintainer is not found for the repo.