CVE-2026-55612Low· 3.7▾ Sunlituhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
uhttpd is a small HTTP server. In unpatched repository snapshots, client_poll_post_data() in client.c consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears r->content_length and r->transfer_chunked without draining the remaining body or setting request.connection_close. The completion check treats the chunked POST as finished and the keep-alive parser returns to CLIENT_STATE_INIT. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
uhttpd >= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3buhttpd >= b7c85a2819b3869279a669d5681f574824589c6c, < 34460b8211d676ef1b9f40d6b775c5e112933690Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55613Medium· 6.9uhttpd: HTTP request smuggling via ubus POST body parse-error desync
CVE-2026-55614Medium· 6.9uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
CVE-2026-30872Critical· 9.8OpenWrt Project is a Linux operating system targeting embedded devices
CVE-2026-30871Critical· 9.8OpenWrt Project is a Linux operating system targeting embedded devices
CVE-2026-55606Medium· 6.5odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
CVE-2026-53921Critical· 9.8odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)