CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, clientparseheader in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r-transferchunked, despite...