{"id":"CVE-2026-55614","title":"uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching","summary":"uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-444"],"vendor":"openwrt","product":"uhttpd","affected":["uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37","uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-06T18:30:38.617991Z"},"published":"2026-10-30","updated":"2026-11-06","sourceUpdated":"2026-11-06T18:31:02.254Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55614","references":[{"url":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf","label":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf"},{"url":"https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837","label":"https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837"},{"url":"https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37","label":"https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37"}],"tags":["cve.org"],"epss":0.00395,"epssPercentile":0.33908,"ingestedAt":"2026-11-05T16:24:31.467Z","slug":"CVE-2026-55614","body":"## Overview\n\nuhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.\n\n## Affected\n\n- `uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37`\n- `uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}