Live › vulnerability › CVE-2026-55612
uhttpd, a small HTTP server, mishandles an invalid chunk-length line in a chunked POST and stops reading the body early. An attacker can then get the leftover body bytes parsed as a separate request on the same keep-alive connection, which is HTTP request smuggling.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Systems running uhttpd built from unpatched repository snapshots that accept chunked POST requests over keep-alive connections are exposed. Builds that include the two patch commits, or that do not run uhttpd, can skip it. The sources do not say which deployments are most exposed.
No product ranges from the sources yet.
b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690.b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690, which the sources say patch the issue.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
uhttpd is a small HTTP server. In unpatched repository snapshots, client_poll_post_data() in client.c consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears r->content_length and r->transfer_chunked without draining the remaining body or setting request.connection_close. The completion check treats the chunked POST as finished and the keep-alive parser returns to CLIENT_STATE_INIT. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-55612")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.