CVE-2026-55612

uhttpd is a small HTTP server. In unpatched repository snapshots, clientpollpostdata in client.c consumes an invalid chunk-length line, such as a size exceeding INTMAX, then clears r-contentlength and r-transferchunked without draining the remaining body or setting request.connectionclose. The...

CVE-2026-55612

The uhttpd HTTP server is vulnerable to HTTP request smuggling and request-boundary desynchronization due to improper handling of chunked POST data in client.c. Specifically, the client_poll_post_data() function fails to correctly handle invalid chunk-length lines (e.g., values exceeding INT_MAX)...

CVE-2026-55612: openwrt uhttpd: uhttpd is a small HTTP server

uhttpd is a small HTTP server. In unpatched repository snapshots, clientpollpostdata in client.c consumes an invalid chunk-length line, such as a size exceeding INTMAX, then clears r-contentlength and r-transferchunked without draining the remaining body or setting request.connectionclose. The...