CVE-2026-55613 - Vulnerability Details

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

openwrt

uhttpd

affected

Version	Status	Constraints
`< 7b1bec45826bd78c8afc993435bdc0f1df2fe399`	affected	—

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399
https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5
https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p

History

Fri, 30 Oct 2026 22:00:00 +0000

Type	Values Removed	Values Added
Description		uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.
Title		uhttpd: HTTP request smuggling via ubus POST body parse-error desync
Weaknesses		CWE-444
References		https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399 https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5 https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`