{"id":"CVE-2026-55613","title":"uhttpd: HTTP request smuggling via ubus POST body parse-error desync","summary":"uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-444"],"vendor":"openwrt","product":"uhttpd","affected":["uhttpd < 7b1bec45826bd78c8afc993435bdc0f1df2fe399"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-05T02:55:16.426726Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T02:55:37.771Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55613","references":[{"url":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p","label":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p"},{"url":"https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399","label":"https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399"},{"url":"https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5","label":"https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5"}],"tags":["cve.org","exploit-available"],"epss":0.00395,"epssPercentile":0.33909,"ingestedAt":"2026-11-05T21:36:00.717Z","slug":"CVE-2026-55613","body":"## Overview\n\nuhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.\n\n## Affected\n\n- `uhttpd < 7b1bec45826bd78c8afc993435bdc0f1df2fe399`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":50,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}