{"id":"CVE-2026-55613","kind":"vulnerability","aliases":["CVE-2026-55613"],"related":[],"title":"uhttpd: split POST body lets smuggled HTTP requests run on keep-alive","description":"uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.","summary":"uhttpd, the small HTTP server used on OpenWrt routers, mishandles a POST /ubus JSON body that arrives across several TCP segments. An attacker can get a second HTTP request hidden in the unread body to be processed as a new request on the same keep-alive connection, which is request smuggling.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","openwrt","routers","self-hosted","ubus","uhttpd"],"not_affected_if":["no-keep-alive-proxy","ubus-disabled"],"how_to_check":"- Check whether uhttpd is running with ubus enabled on the device or server, for example by reviewing the uhttpd config for `ubus_prefix` or `ubus_cors` settings (unknown whether the sources name a specific default).\n- Confirm the installed uhttpd version and compare it to the repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5.\n- Check whether uhttpd sits behind a proxy or CDN that reuses keep-alive connections to it.","fix":"- Apply the repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 to uhttpd.\n- Fixed release versions: unknown; the sources do not state them.","status":"open","published_at":"2026-10-30T22:16:55+00:00","first_seen_at":"2026-10-30T22:25:56+00:00","triaged_at":"2026-10-30T22:27:16+00:00","updated_at":"2026-10-30T22:27:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-30T22:27:16Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 to uhttpd.\n- Fixed release versions: unknown; the sources do not state them.","reach":"network","title":"uhttpd: split POST body lets smuggled HTTP requests run on keep-alive","impact":"medium","summary":"uhttpd, the small HTTP server used on OpenWrt routers, mishandles a POST /ubus JSON body that arrives across several TCP segments. An attacker can get a second HTTP request hidden in the unread body to be processed as a new request on the same keep-alive connection, which is request smuggling.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openwrt","uhttpd","ubus","self-hosted","routers"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Hidden HTTP requests get processed on a shared keep-alive connection","analyst_note":"Confirm the default ubus setting in OpenWrt uhttpd and the fixed release versions; the sources give only repository commit hashes and no CVSS vector details.","how_to_check":"- Check whether uhttpd is running with ubus enabled on the device or server, for example by reviewing the uhttpd config for `ubus_prefix` or `ubus_cors` settings (unknown whether the sources name a specific default).\n- Confirm the installed uhttpd version and compare it to the repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5.\n- Check whether uhttpd sits behind a proxy or CDN that reuses keep-alive connections to it.","plain_action":"","needs_analyst":true,"not_affected_if":["ubus-disabled","no-keep-alive-proxy"],"who_is_affected":"Exposure requires uhttpd with ubus enabled, which the sources say includes the default OpenWrt configuration, and a POST /ubus request whose JSON body is split across TCP segments. Deployments that proxy or CDN traffic to uhttpd over reused keep-alive connections are the most relevant. Systems where ubus is disabled are not described as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000864,"input_tokens":4389,"output_tokens":851,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-55613':16A,19A '/ubus':40B,104C '7b1bec45826bd78c8afc993435bdc0f1df2fe399':231C 'across':45B 'address':234C 'affect':216C 'aliv':13A,74B,174C 'applic':194C 'application-lay':193C 'arriv':44B,107C 'attack':50B 'b2285de129b9adc8b12f84f9a27c16c21f2b57a5':233C 'bodi':4A,42B,61B,106C,160C,197C 'body-handl':196C 'boundari':100C 'byte':137C 'caller':140C 'case':207C 'chunk':211C 'chunk-length':210C 'close':152C 'complet':115C 'configur':224C 'connect':75B,151C,175C 'consequ':163C 'consum':138C 'content':147C 'content-length':146C 'cve':14A,17A 'data':92C 'declar':145C 'default':222C 'deploy':217C,228C 'desynchron':97C 'distinct':201C 'drain':142C 'du':120C 'embed':156C 'enabl':218C 'encod':205C 'error':132C,185C 'exist':128C 'existing-object':127C 'flaw':199C 'follow':186C 'get':52B 'handl':208C 'handler':198C 'header':206C 'hidden':57B 'host':25B 'http':7A,31B,55B,84C,98C,154C,190C 'includ':220C 'infrastructur':20B 'initi':113C 'issu':236C 'jsobj':121C 'json':41B,105C,117C,182C 'json-rpc':181C 'keep':12A,73B,173C 'keep-al':11A,72B,172C 'later':123C 'layer':195C 'length':148C,212C 'let':5A 'mishandl':37B 'multipl':109C 'neither':141C 'new':67B,167C 'object':118C,129C 'openwrt':21B,35B,223C 'pars':131C,184C 'parse-error':130C 'patch':230C 'path':133C 'post':3A,39B,103C 'potenti':226C 'process':64B,164C 'proxy/cdn':227C 'remain':144C 'report':177C 'repositori':88C,229C 'reproduc':178C 'request':8A,56B,68B,78B,99C,155C,168C 'reset':214C 'respons':191C 'return':135C,179C 'router':22B,36B 'rpc':183C 'run':9A 'second':54B,189C 'segment':48B,111C,114C,124C 'self':24B 'self-host':23B 'send':93C 'server':32B,85C 'set':119C,150C 'sever':46B 'small':30B,83C 'smuggl':6A,79B 'snapshot':89C 'split':2A 'state':213C 'suffix':161C 'take':125C 'tcp':47B,110C 'transfer':204C 'transfer-encod':203C 'ubus':26B,91C,219C 'ubus.c':95C 'uh':90C 'uhttpd':1A,27B,28B,80C 'unpatch':87C 'unread':60B,159C 'use':33B 'zero':136C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires uhttpd with ubus enabled, which the sources say includes the default OpenWrt configuration, and a POST /ubus request whose JSON body is split across TCP segments. Deployments that proxy or CDN traffic to uhttpd over reused keep-alive connections are the most relevant. Systems where ubus is disabled are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T22:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55613","severity":null,"published_at":"2026-10-30T22:16:55+00:00","modified_at":"2026-10-30T22:16:55+00:00","first_seen_at":"2026-10-30T22:25:56+00:00","fetched_at":"2026-10-30T22:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}