CVE-2026-55614 Details
Description
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.
A vulnerability in uhttpd, a lightweight HTTP server, allows for HTTP request smuggling. This issue arises because the server's header parsing function lowercases header names but compares the 'Transfer-Encoding' value to 'chunked' in a case-sensitive manner. As a result, a mixed-case 'Transfer-Encoding' header is accepted without enabling chunked transfer, despite the fact that transfer-coding tokens should be treated as case-insensitive. On a keep-alive connection, the unprocessed chunked data is misinterpreted as a new HTTP request, creating a desynchronization issue. This vulnerability affects unpatched repository snapshots prior to commit '1b624f8f814ed568608d756512892416e0431d77'.
Users can update to the latest version of uhttpd, where this vulnerability has been patched. Instructions for updating can be found in the uhttpd repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 | [email protected] | Source CodeVendor |
| https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37 | [email protected] | Source CodeVendor |
| https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwrt uhttpd | < 1b624f8f814ed568608d756512892416e0431d77 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |