Read the docs
TI-2026-83426 Aliases CVE-2026-55614

HTTP request smuggling in uhttpd via mixed-case Transfer-Encoding

Priority LOW 37CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

uhttpd, the small HTTP server from OpenWrt, is affected from commit 2bef561c890f275ce3b785e6abdb3eda28c96aa8 before commit 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837. Its header parser compares the Transfer-Encoding value to chunked case-sensitively (CWE-444), so a mixed-case transfer coding is not treated as chunked. An unauthenticated remote attacker can smuggle requests, because the unread chunked POST body is parsed as another request on a keep-alive connection.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00395 33rd percentileScored 2026-11-07
Fix Fixed uhttpd (openwrt): 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openwrtuhttpd>= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37; 2bef561c890f275ce3b785e6abdb3eda28c96aa8 to before 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e98376641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837Patch availableCNA
  • uhttpd Vendoropenwrt Affected >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37; 2bef561c890f275ce3b785e6abdb3eda28c96aa8 to before 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 Fixed in 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 Patch available CNA

Remediation

Update uhttpd to commit 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 or later, which fixes the issue. Commit ae015e099986ceace44975cb69629841a2d58d37 also patches it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA uhttpd (openwrt) Fixed in 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-55614
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-06 CISA SSVC decision points changed

References

Other 3

  • TI-2026-79903 Stack buffer overflow in odhcpd DHCPv6 IA reply handling CVSS 3.1CRITICAL 9.8
  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2026-79901 Use-after-free in odhcpd DHCPv6 IA handling CVSS 4.0HIGH 8.8
  • TI-2026-48502 OpenWrt luci-app-bmx7 Path Traversal via bmx7-info CVSS 4.0HIGH 8.7
  • TI-2026-44407 luci-app-banip Log Monitor IP Extraction Bypass CVSS 4.0HIGH 8.7
  • TI-2026-51067 luci-app-openvpn Path Traversal RCE via instance_name2 CVSS 4.0CRITICAL 9.4
See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences