Live › vulnerability › CVE-2026-55613
uhttpd, the small HTTP server used on OpenWrt routers, mishandles a POST /ubus JSON body that arrives across several TCP segments. An attacker can get a second HTTP request hidden in the unread body to be processed as a new request on the same keep-alive connection, which is request smuggling.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Exposure requires uhttpd with ubus enabled, which the sources say includes the default OpenWrt configuration, and a POST /ubus request whose JSON body is split across TCP segments. Deployments that proxy or CDN traffic to uhttpd over reused keep-alive connections are the most relevant. Systems where ubus is disabled are not described as affected.
No product ranges from the sources yet.
ubus_prefix or ubus_cors settings (unknown whether the sources name a specific default).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
uhttpd is a small HTTP server. In unpatched repository snapshots, uh_ubus_data_send() in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du->jsobj; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared Content-Length nor sets connection_close. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-55613")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.