Application-layer Flaw in OpenWrt's uHTTP Server Leads to Request Processing Issues

CVE-2026-55613

What is CVE-2026-55613?

The uHTTP server in OpenWrt has a vulnerability that arises in scenarios where POST requests with JSON bodies are transmitted in multiple TCP segments. This issue occurs in the uh_ubus_data_send() function found in ubus.c, leading to desynchronized HTTP request boundaries. When the server receives an initial segment that completes a JSON object, it mistakenly sets du->jsobj, while subsequent segments can trigger parse errors and fail to consume the full declared Content-Length. Consequently, any remaining HTTP request data is incorrectly interpreted as a new request on the same keep-alive connection. This flaw primarily impacts configurations that enable ubus, including the default OpenWrt setup and various proxy or CDN setups. Fixes are available in repository patches that address these parsing issues effectively.

References