OpenWrt uhttpd Keep-Alive Parser client.c client_poll_post_data content_length/transfer_chunked request smuggling

Summaryinfo

A vulnerability classified as problematic has been found in OpenWrt uhttpd. The affected element is the function client_poll_post_data of the file client.c of the component Keep-Alive Parser. Performing a manipulation of the argument content_length/transfer_chunked results in request smuggling. This vulnerability is known as CVE-2026-55612. Remote exploitation of the attack is possible. No exploit is available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as problematic has been found in OpenWrt uhttpd (version now known). This affects the function client_poll_post_data of the file client.c of the component Keep-Alive Parser. The manipulation of the argument content_length/transfer_chunked with an unknown input leads to a request smuggling vulnerability. CWE is classifying the issue as CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. This is going to have an impact on integrity. The summary by CVE is:

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-55612 since 06/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch b78f518478794e16ba3568fc1258e40bf3e8eb3b/34460b8211d676ef1b9f40d6b775c5e112933690 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• OpenWrt

Name

• uhttpd

Website

• Product: https://github.com/openwrt/uhttpd/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion