Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55612— uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset

Quick assessment

Affected
openwrt uhttpd
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

uhttpd 是一个轻量级 HTTP 服务器。在未打补丁的代码仓库快照中， 文件里的 函数会错误地处理无效的块长度行（例如长度超过 INT_MAX 的情况），随后清空 和 字段，却未读取剩余请求体，也未设置 。完成检查因此将分块 POST 请求误判为已结束，使保持连接（keep-alive）解析器返回到 状态。此时，攻击者可控的请求体字节若恰好对齐为完整的 HTTP 请求，将被解析并作为同一连接上的新请求进行处理，从而引发 HTTP 请求走私（HTTP request smuggling）和请求边界失步。提交 b7

CVSS 3.7 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55612

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
Source: CVE Program / CVE List V5
Vulnerability Description
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
openwrt uhttpd >= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3b -

II. Public POCs for CVE-2026-55612

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55612

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55612 (2)

Vendor Advisories for CVE-2026-55612 (1)

Same Patch Batch · openwrt · 2026-10-30 · 3 CVEs total

CVE-2026-55614 6.9 MEDIUM uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
CVE-2026-55613 6.9 MEDIUM uhttpd: HTTP request smuggling via ubus POST body parse-error desync

IV. Related Vulnerabilities

Same product: uhttpd
Same vendor: openwrt
Same weakness: CWE-444