uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
uhttpd builds before commit 1b624f8f814ed568608d756512892416e0431d77 are affected when requests are pipelined on one keep-alive connection. CVSS scores it 6.9 (medium); no vendor rating is given. No fix is listed.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The uhttpd lightweight HTTP server is affected. A flaw in how it handles the Transfer-Encoding header can let an attacker smuggle a second hidden request inside a single connection, which can cause requests to be interpreted differently by the server and any proxy in front of it.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- openwrt uhttpd
Version range not reported
References 3
GitHub · openwrt/uhttpd
Questions about CVE-2026-55614
What does this mean?
uhttpd matches the Transfer-Encoding header case-sensitively, so a value such as Chunked with a capital C is not recognized as chunked. The server then parses unread chunked body bytes as a separate HTTP request, which desynchronizes request boundaries on a keep-alive connection.Source: github.com, github.com
Am I affected, and how do I check?
Affected are uhttpd versions before commit 1b624f8f814ed568608d756512892416e0431d77, in setups where requests are pipelined on one keep-alive connection. To check a build, compare its source or package revision against that commit.Source: github.com, github.com
What should I do about it?
Update uhttpd to a build that includes commit 1b624f8f814ed568608d756512892416e0431d77 or later. The checked facts do not name a released version that contains the fix.Source: github.com, github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts do not list a workaround. Until a fixed build is installed, the facts give no stated way to limit exposure.Source: github.com, github.com