---
id: CVE-2026-55612
title: >-
  uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state
  reset
summary: >-
  uhttpd is a small HTTP server. In unpatched repository snapshots,
  `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line,
  such as a size exceeding INT_MAX, then clears `r->content_length` and
  `r->transfer_chunked` …
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-444
vendor: openwrt
product: uhttpd
affected:
  - >-
    uhttpd >= b7c85a2819b3869279a669d5681f574824589c6c, <
    b78f518478794e16ba3568fc1258e40bf3e8eb3b
  - >-
    uhttpd >= b7c85a2819b3869279a669d5681f574824589c6c, <
    34460b8211d676ef1b9f40d6b775c5e112933690
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:03:23.416603Z'
published: '2026-10-30'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T18:09:13.455Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-55612'
references:
  - url: 'https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5'
    label: 'https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5'
  - url: >-
      https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690
    label: >-
      https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690
  - url: >-
      https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b
    label: >-
      https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b
tags:
  - cve.org
epss: 0.0029
epssPercentile: 0.21648
ingestedAt: '2026-11-05T19:30:42.766Z'
---

## Overview

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.

## Affected

- `uhttpd >= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3b`
- `uhttpd >= b7c85a2819b3869279a669d5681f574824589c6c, < 34460b8211d676ef1b9f40d6b775c5e112933690`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.