uhttpd HTTP Request Smuggling via Transfer-Encoding

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-55614

Affected Vendors & Products

Vendor	Product	Version / Range
openwrt	uhttpd	>= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37
openwrt	uhttpd	>= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability exists in uhttpd, a small HTTP server. The issue occurs in the client_parse_header function where header names are lowercased but the Transfer-Encoding value is compared case-sensitively to chunked. This allows mixed-case transfer-coding tokens to bypass proper handling, leaving POST body data unread on keep-alive connections. Attackers can exploit this to parse request-shaped body bytes as another HTTP request, enabling HTTP request smuggling and boundary desynchronization.

Impact Analysis

This vulnerability can allow attackers to smuggle HTTP requests, bypass security controls, or manipulate how requests are processed. It may lead to unauthorized access, data leaks, or denial of service by desynchronizing request boundaries. Systems using vulnerable uhttpd versions are at risk, especially if exposed to untrusted networks.

Mitigation Strategies

Update uhttpd to the latest patched version from the repository to apply commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837.

Hi! I’m here to help you understand CVE-2026-55614. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70