Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55614— uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching

Quick assessment

Affected
openwrt uhttpd
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

uhttpd 是一个小型 HTTP 服务器。在未打补丁的仓库快照版本中， 文件里的 函数会将请求头名称转换为小写，但在比较 头的值与 时，却使用了区分大小写的 函数。尽管传输编码令牌（transfer-coding tokens）在规范中是大小写不敏感的，但混合大小写的令牌仍会被接受，而不会设置 标志。在保持连接（keep-alive）的场景下， 编码的 POST 请求体将不会被读取，导致后续的请求体字节被误解析为另一个 HTTP 请求，从而引发 HTTP 请求走私（HTTP request smuggling）和

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55614

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
Source: CVE Program / CVE List V5
Vulnerability Description
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
openwrt uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37 -

II. Public POCs for CVE-2026-55614

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55614

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55614 (2)

Vendor Advisories for CVE-2026-55614 (1)

Same Patch Batch · openwrt · 2026-10-30 · 3 CVEs total

CVE-2026-55613 6.9 MEDIUM uhttpd: HTTP request smuggling via ubus POST body parse-error desync
CVE-2026-55612 3.7 LOW uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset

IV. Related Vulnerabilities

Same product: uhttpd
Same vendor: openwrt
Same weakness: CWE-444