---
id: "CVE-2026-55612"
kind: "vulnerability"
aliases: ["CVE-2026-55612"]
title: "uhttpd: invalid chunked POST lets attackers smuggle HTTP requests"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["chunked-encoding", "keep-alive", "runtime", "uhttpd"]
not_affected_if: ["patched-commits"]
published_at: "2026-10-30T22:16:54+00:00"
first_seen_at: "2026-10-30T22:25:56+00:00"
updated_at: "2026-10-30T22:27:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55612", "first_seen_at": "2026-10-30T22:25:56+00:00"}]
---

# uhttpd: invalid chunked POST lets attackers smuggle HTTP requests

uhttpd, a small HTTP server, mishandles an invalid chunk-length line in a chunked POST and stops reading the body early. An attacker can then get the leftover body bytes parsed as a separate request on the same keep-alive connection, which is HTTP request smuggling.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your uhttpd source includes commits `b78f518478794e16ba3568fc1258e40bf3e8eb3b` and `34460b8211d676ef1b9f40d6b775c5e112933690`.
- Look at the uhttpd version or snapshot your build uses; the sources flag unpatched repository snapshots as affected.

## Fix

- uhttpd: include commits `b78f518478794e16ba3568fc1258e40bf3e8eb3b` and `34460b8211d676ef1b9f40d6b775c5e112933690`, which the sources say patch the issue.

## Timeline

- 2026-10-30T22:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55612

## From the sources

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_