HTTP Server Vulnerability in uhttpd by OpenWrt
CVE-2026-55614

6.9MEDIUM

Key Information:

Vendor

Openwrt

Status
Uhttpd
Vendor
CVE Published:
30 October 2026

What is CVE-2026-55614?

A vulnerability in uhttpd, a compact HTTP server used in various OpenWrt installations, allows for HTTP request smuggling due to the improper handling of the Transfer-Encoding header. When specific conditions are met, mixed-case transfer-coding tokens are incorrectly processed as if they are valid, which can lead to unsanitized POST bodies and unintended parsing of data. This manipulation could allow an attacker to craft malicious HTTP requests that exploit the server's response behavior, leading to potential desynchronization and further security breaches. Patches are available in recent commits to address this issue.

Affected Version(s)

uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37 < 2bef561c890f275ce3b785e6abdb3eda28c96aa8, ae015e099986ceace44975cb69629841a2d58d37

uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 < 2bef561c890f275ce3b785e6abdb3eda28c96aa8, 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837

References

https://github.com/openwrt/uhttpd/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd...
x_refsource_MISC
https://github.com/openwrt/uhttpd/commit/ae015e099986ceac...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.