CVE-2026-55612 in uhttpd
Summary
by MITRE • 10/30/2026
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability resides within uhttpd, a lightweight HTTP server commonly deployed in embedded systems and IoT devices due to its small footprint and efficiency. The specific flaw is located in the `client_poll_post_data()` function found in the source file `client.c`. This component is responsible for handling incoming data chunks during an HTTP POST request that utilizes chunked transfer encoding. In unpatched versions of the software, specifically those derived from repository snapshots prior to the specified fixes, the server fails to properly validate or handle invalid chunk-length lines where the declared size exceeds the maximum integer value (INT_MAX). Instead of rejecting such malformed requests or handling them safely, the flawed logic proceeds to clear internal state variables `r->content_length` and `r->transfer_chunked`, effectively signaling that the current request body has been fully consumed.
This incorrect state transition leads to a critical operational failure where the server does not drain the remaining bytes from the connection buffer nor does it set the `request.connection_close` flag, which would normally terminate the keep-alive session after an error or malformed input. Consequently, the completion check logic erroneously treats the chunked POST request as successfully finished and closed. The HTTP parser then immediately returns to the initial state, `CLIENT_STATE_INIT`, preparing to parse a new request on the same persistent TCP connection without ensuring that all data from the previous transaction has been processed. This desynchronization between the application layer's understanding of the message boundary and the actual stream of bytes creates an opening for HTTP Request Smuggling attacks.
An attacker can exploit this condition by sending a maliciously crafted POST request with a chunked body containing an oversized or invalid length field, followed immediately by another valid HTTP request within the same TCP connection. Because uhttpd incorrectly assumes the first request is complete and resets its state, it will parse the subsequent bytes as a new, distinct HTTP request. This allows the attacker to smuggle requests that may bypass security controls such as Web Application Firewalls or access control lists if those devices operate on different parsing logic than the vulnerable backend server. The result is a violation of request boundary integrity, potentially leading to unauthorized data access, cache poisoning, or other downstream attacks depending on how the application processes these smuggled requests.
From a classification perspective, this vulnerability aligns with CWE-20: Improper Input Validation, as the software fails to validate the chunk length against expected limits before processing it further. It also maps directly to MITRE ATT&CK technique T1137: HTTP Request Smuggling, which involves exploiting differences in how front-end and back-end servers interpret HTTP requests to bypass security measures or inject malicious content. The lack of proper connection closure after a malformed request exacerbates the risk by allowing persistent connections to be hijacked for multiple smuggling attempts without re-authentication or session reset.
To mitigate this vulnerability, organizations must ensure that uhttpd is updated to versions containing commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690. These patches correct the logic to properly handle invalid chunk lengths by either rejecting the request or ensuring that all remaining data is drained and the connection is closed appropriately. In environments where immediate patching is not feasible, network-level mitigations such as deploying a reverse proxy with robust HTTP parsing capabilities can help detect and block malformed requests before they reach the vulnerable uhttpd instance. Additionally, enforcing strict input validation on chunked transfer encoding parameters at the application level or using WAF rules to identify potential smuggling patterns can provide an additional layer of defense against exploitation attempts targeting this specific desynchronization flaw.