CVE-2026-55614Medium· 6.9▾ Sunlituhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
uhttpd is a small HTTP server. In unpatched repository snapshots, client_parse_header() in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r->transfer_chunked, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the chunked POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.
uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55613Medium· 6.9uhttpd: HTTP request smuggling via ubus POST body parse-error desync
CVE-2026-55612Low· 3.7uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
CVE-2026-30872Critical· 9.8OpenWrt Project is a Linux operating system targeting embedded devices
CVE-2026-30871Critical· 9.8OpenWrt Project is a Linux operating system targeting embedded devices
CVE-2026-55606Medium· 6.5odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
CVE-2026-53921Critical· 9.8odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)