Search
Find a vulnerability
Search criteria
6 vulnerabilities found for uhttpd by openwrt
CVE-2026-55614 (GCVE-0-2026-55614)
Vulnerability from nvd – Published: 2026-10-30 22:01 – Updated: 2026-10-30 22:01
VLAI
EPSS
VEX
Title
uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
Summary
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.
Severity
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/uhttpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/uhttpd/commit/6641b050… | x_refsource_MISC |
| https://github.com/openwrt/uhttpd/commit/ae015e09… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "uhttpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003e= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, \u003c ae015e099986ceace44975cb69629841a2d58d37"
},
{
"status": "affected",
"version": "\u003e= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, \u003c 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r-\u003etransfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:01:54.750Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37"
}
],
"source": {
"advisory": "GHSA-mcfg-c4r7-pjpf",
"discovery": "UNKNOWN"
},
"title": "uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55614",
"datePublished": "2026-10-30T22:01:54.750Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-10-30T22:01:54.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55613 (GCVE-0-2026-55613)
Vulnerability from nvd – Published: 2026-10-30 21:57 – Updated: 2026-11-05 02:55
VLAI
EPSS
VEX
Title
uhttpd: HTTP request smuggling via ubus POST body parse-error desync
Summary
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 02:55 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/uhttpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/uhttpd/commit/7b1bec45… | x_refsource_MISC |
| https://github.com/openwrt/uhttpd/commit/b2285de1… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55613",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T02:55:16.426726Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T02:55:37.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "uhttpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 7b1bec45826bd78c8afc993435bdc0f1df2fe399"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du-\u003ejsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T21:57:19.199Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5"
}
],
"source": {
"advisory": "GHSA-wgwp-64hh-f52p",
"discovery": "UNKNOWN"
},
"title": "uhttpd: HTTP request smuggling via ubus POST body parse-error desync"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55613",
"datePublished": "2026-10-30T21:57:19.199Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-11-05T02:55:37.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55612 (GCVE-0-2026-55612)
Vulnerability from nvd – Published: 2026-10-30 22:00 – Updated: 2026-11-02 18:09
VLAI
EPSS
VEX
Title
uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
Summary
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:03 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/uhttpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/uhttpd/commit/34460b82… | x_refsource_MISC |
| https://github.com/openwrt/uhttpd/commit/b78f5184… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:03:23.416603Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:09:13.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "uhttpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003e= b7c85a2819b3869279a669d5681f574824589c6c, \u003c b78f518478794e16ba3568fc1258e40bf3e8eb3b"
},
{
"status": "affected",
"version": "\u003e= b7c85a2819b3869279a669d5681f574824589c6c, \u003c 34460b8211d676ef1b9f40d6b775c5e112933690"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r-\u003econtent_length` and `r-\u003etransfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:00:19.756Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b"
}
],
"source": {
"advisory": "GHSA-p55c-rmhc-qfm5",
"discovery": "UNKNOWN"
},
"title": "uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55612",
"datePublished": "2026-10-30T22:00:19.756Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-11-02T18:09:13.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55614 (GCVE-0-2026-55614)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:01 – Updated: 2026-10-30 22:01
VLAI
EPSS
VEX
Title
uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
Summary
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.
Severity
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/uhttpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/uhttpd/commit/6641b050… | x_refsource_MISC |
| https://github.com/openwrt/uhttpd/commit/ae015e09… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "uhttpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003e= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, \u003c ae015e099986ceace44975cb69629841a2d58d37"
},
{
"status": "affected",
"version": "\u003e= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, \u003c 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r-\u003etransfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:01:54.750Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37"
}
],
"source": {
"advisory": "GHSA-mcfg-c4r7-pjpf",
"discovery": "UNKNOWN"
},
"title": "uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55614",
"datePublished": "2026-10-30T22:01:54.750Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-10-30T22:01:54.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55612 (GCVE-0-2026-55612)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:00 – Updated: 2026-11-02 18:09
VLAI
EPSS
VEX
Title
uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
Summary
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:03 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/uhttpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/uhttpd/commit/34460b82… | x_refsource_MISC |
| https://github.com/openwrt/uhttpd/commit/b78f5184… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:03:23.416603Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:09:13.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "uhttpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003e= b7c85a2819b3869279a669d5681f574824589c6c, \u003c b78f518478794e16ba3568fc1258e40bf3e8eb3b"
},
{
"status": "affected",
"version": "\u003e= b7c85a2819b3869279a669d5681f574824589c6c, \u003c 34460b8211d676ef1b9f40d6b775c5e112933690"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r-\u003econtent_length` and `r-\u003etransfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:00:19.756Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b"
}
],
"source": {
"advisory": "GHSA-p55c-rmhc-qfm5",
"discovery": "UNKNOWN"
},
"title": "uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55612",
"datePublished": "2026-10-30T22:00:19.756Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-11-02T18:09:13.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55613 (GCVE-0-2026-55613)
Vulnerability from cvelistv5 – Published: 2026-10-30 21:57 – Updated: 2026-11-05 02:55
VLAI
EPSS
VEX
Title
uhttpd: HTTP request smuggling via ubus POST body parse-error desync
Summary
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 02:55 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/uhttpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/uhttpd/commit/7b1bec45… | x_refsource_MISC |
| https://github.com/openwrt/uhttpd/commit/b2285de1… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55613",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T02:55:16.426726Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T02:55:37.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "uhttpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 7b1bec45826bd78c8afc993435bdc0f1df2fe399"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du-\u003ejsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T21:57:19.199Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399"
},
{
"name": "https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5"
}
],
"source": {
"advisory": "GHSA-wgwp-64hh-f52p",
"discovery": "UNKNOWN"
},
"title": "uhttpd: HTTP request smuggling via ubus POST body parse-error desync"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55613",
"datePublished": "2026-10-30T21:57:19.199Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-11-05T02:55:37.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}