---
id: CVE-2026-55614
title: >-
  uhttpd vulnerable to HTTP request smuggling via case-sensitive
  Transfer-Encoding matching
summary: >-
  uhttpd is a small HTTP server. In unpatched repository snapshots,
  `client_parse_header()` in `client.c` lowercases header names but compares the
  `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A
  mixed-case transfer-…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-444
vendor: openwrt
product: uhttpd
affected:
  - >-
    uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, <
    ae015e099986ceace44975cb69629841a2d58d37
  - >-
    uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, <
    6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T18:30:38.617991Z'
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:31:02.254Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-55614'
references:
  - url: 'https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf'
    label: 'https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf'
  - url: >-
      https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837
    label: >-
      https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837
  - url: >-
      https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37
    label: >-
      https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37
tags:
  - cve.org
epss: 0.00395
epssPercentile: 0.33954
ingestedAt: '2026-11-05T16:24:31.467Z'
---

## Overview

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.

## Affected

- `uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < ae015e099986ceace44975cb69629841a2d58d37`
- `uhttpd >= 2bef561c890f275ce3b785e6abdb3eda28c96aa8, < 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.