{"id":"CVE-2026-55612","state":"PUBLISHED","title":"uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset","description":"uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.","publishedAt":"2026-10-30T22:00:19.756Z","updatedAt":"2026-10-30T22:00:19.756Z","severity":{"score":3.7,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["openwrt uhttpd"],"affected":[{"vendor":"openwrt","product":"uhttpd","versions":[{"version":">= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3b","status":"affected"},{"version":">= b7c85a2819b3869279a669d5681f574824589c6c, < 34460b8211d676ef1b9f40d6b775c5e112933690","status":"affected"}]}],"references":["https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5","https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690","https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b"],"weaknesses":["CWE-444"],"ingestedAt":"2026-10-30T22:16:06.501Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/55xxx/CVE-2026-55612.json","commit":"226652b7321cd45ef01add6f464a8114b52515e5","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-55612","state":"PUBLISHED","datePublished":"2026-10-30T22:00:19.756Z","dateUpdated":"2026-10-30T22:00:19.756Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-06-16T23:31:22.445Z"},"containers":{"cna":{"title":"uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset","descriptions":[{"lang":"en","value":"uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue."}],"affected":[{"vendor":"openwrt","product":"uhttpd","versions":[{"version":">= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3b","status":"affected"},{"version":">= b7c85a2819b3869279a669d5681f574824589c6c, < 34460b8211d676ef1b9f40d6b775c5e112933690","status":"affected"}]}],"references":[{"url":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5","name":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690","name":"https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690","tags":["x_refsource_MISC"]},{"url":"https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b","name":"https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-444","lang":"en","description":"CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-10-30T22:00:19.756Z"},"source":{"advisory":"GHSA-p55c-rmhc-qfm5","discovery":"UNKNOWN"}}}}}