CVE-2026-55613 in uhttpd
Summary
by MITRE • 10/30/2026
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability resides within the uhttpd HTTP server, specifically in the ubus_data_send function located in the ubus.c source file. This component is critical for deployments that enable the Unified Bus (ubus) interface, which is a default configuration in OpenWrt systems and potentially present in other embedded or proxy environments. The core technical flaw involves an incorrect handling of HTTP request boundaries when processing POST requests to the /ubus endpoint with JSON bodies that are fragmented across multiple TCP segments. In unpatched versions, the server fails to properly manage state transitions during multi-segment parsing, leading to a desynchronization between the application layer logic and the underlying transport stream.
When an initial TCP segment arrives containing data that completes a valid JSON object, the parser sets the internal du->jsobj flag to indicate successful processing of that specific unit. However, if subsequent segments arrive with additional data or malformed content, the code path diverges into an existing-object parse-error branch. In this scenario, the function returns zero bytes consumed, indicating that no further progress was made in parsing the current request body. Crucially, the calling logic fails to account for this partial consumption state by neither draining the remaining declared Content-Length from the input buffer nor setting a connection_close flag on the socket. This omission leaves unread data lingering in the TCP receive buffer while the server assumes the previous logical unit is fully resolved or discarded without proper stream alignment.
The operational impact of this flaw is severe, as it enables HTTP request smuggling and response splitting attacks via body-based desynchronization. Because the remaining bytes from the original Content-Length declaration are not consumed, they remain in the connection's input buffer. When uhttpd subsequently attempts to read a new request for keep-alive connections, it interprets these leftover bytes as the start of a fresh HTTP request. This allows an attacker to inject arbitrary HTTP requests into the stream, effectively bypassing any front-end security controls or proxies that rely on strict boundary adherence. The reported reproducer demonstrates this by triggering a JSON-RPC parse error followed immediately by the processing and return of a second, injected HTTP response, confirming that the server has misinterpreted the tail end of one request as the head of another.
This vulnerability is distinct from common Transfer-Encoding or chunk-length state reset issues often seen in other web servers. It specifically targets the application-layer body handler's inability to maintain strict boundary integrity when dealing with fragmented TCP streams and JSON parsing errors. The flaw affects any deployment where ubus is enabled, including default OpenWrt installations and potential proxy or CDN configurations that terminate HTTPS connections and forward HTTP traffic to uhttpd backends. Attackers can exploit this to perform unauthorized actions, escalate privileges by injecting administrative commands via the ubus interface, or conduct cross-site request forgery attacks against internal services protected only by network-level segmentation.
Mitigation requires applying the repository patches identified as 7b1bec45826bd78c8afc9935bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5. These updates correct the state management logic to ensure that partial reads or parse errors result in proper stream draining or connection termination, thereby preventing request smuggling. Organizations should also consider implementing strict input validation and rate limiting on ubus endpoints as a defense-in-depth measure. From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation regarding the handling of malformed HTTP requests, and it facilitates techniques described in MITRE ATT&CK such as T1190 Exploit Public-Facing Application or T1534 Internal Spearphishing if used for lateral movement within a compromised network segment. Immediate patching is recommended to restore boundary integrity and prevent exploitation by automated scanners or targeted attackers seeking access to embedded system management interfaces.