CVE-2026-55612 Details
Description
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
A vulnerability in the uhttpd HTTP server, specifically in unpatched repository snapshots, allows for HTTP request smuggling. The issue arises in the 'client_poll_post_data()' function within 'client.c', where the server improperly handles chunked POST requests with invalid chunk lengths, such as sizes exceeding INT_MAX. This mismanagement clears the content length and chunked transfer flags without draining the remaining body data or closing the connection. As a result, the keep-alive parser resets to the initial state and misinterprets the leftover bytes as a new request on the same connection. Exploitation involves embedding a complete HTTP request within the body of a chunked POST, aligning it to be processed as a separate request,
Users can update to the latest version of uhttpd, where this vulnerability has been patched. Instructions for updating can be found in the OpenWrt uhttpd repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690 | [email protected] | Source CodeVendor |
| https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b | [email protected] | Source CodeVendor |
| https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwrt uhttpd | < 1b624f8f814ed568608d756512892416e0431d77 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |