EUVD-2026-114522

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

CVE-2026-55613 uhttpd: HTTP request smuggling via ubus POST body parse-error desync

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

CVE-2026-55613

The uhttpd HTTP server contains an application-layer body-handler flaw in the uh_ubus_data_send() function within ubus.c . When a POST /ubus JSON body arrives in multiple TCP segments, an initial segment completing a JSON object can cause subsequent segments to take an existing-object parse-error...

CVE-2026-55613: openwrt uhttpd: uhttpd is a small HTTP server

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...