CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, clientparseheader in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r-transferchunked, despite...

CVE-2026-55614

The uhttpd HTTP server is vulnerable to HTTP request smuggling and boundary desynchronization due to a case-sensitivity flaw in header parsing. Specifically, the client_parse_header() function in client.c correctly lowercases header names but uses a case-sensitive strcmp to check the Transfer-Enc...

CVE-2026-55614: openwrt uhttpd: uhttpd is a small HTTP server

uhttpd is a small HTTP server. In unpatched repository snapshots, clientparseheader in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r-transferchunked, despite...