Vulnerability in Openwrt Uhttpd
CVE-2026-55612
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
Vulnerability class: HTTP Request Smuggling
Published .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Openwrt Uhttpd — versions >= b7c85a2819b3869279a669d5681f574824589c6c, < 34460b8211d676ef1b9f40d6b775c5e112933690, >= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3b
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-55612?
- CVE-2026-55612 is a low-severity vulnerability in Openwrt Uhttpd, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 3.7/10. Published 2026-10-30.
- How severe is CVE-2026-55612?
- Low severity. CVSS v3 base score is 3.7 out of 10.