{"id":"CVE-2026-55612","aliases":[],"cve":{"records":[{"id":"CVE-2026-55612","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-16T23:31:22.445Z","published":"2026-10-30T22:00:19.756Z","modified":"2026-10-30T22:00:19.756Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T22:00:19.756Z"}],"references":[{"url":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-444","description":"CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.","score":3.7,"severity":"low","published":"2026-10-30T22:00:19.756Z","modified":"2026-10-30T22:00:19.756Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"openwrt","name":"uhttpd","platforms":[],"versions":[{"version":">= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3b","status":"affected"},{"version":">= b7c85a2819b3869279a669d5681f574824589c6c, < 34460b8211d676ef1b9f40d6b775c5e112933690","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-55612"}],"remediation":[],"references":["https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5","https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690","https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b"],"sources":[{"name":"CVE","id":"CVE-2026-55612","modified":"2026-10-30T22:00:19.756Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-55612"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7}],"sourceAffected":[],"observedAt":"2026-10-30T22:48:31.427Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T23:25:34.849Z","attemptedAt":"2026-10-30T23:25:34.849Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T23:25:34.947Z","attemptedAt":"2026-10-30T23:25:34.947Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T23:25:34.938Z","attemptedAt":"2026-10-30T23:25:34.938Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T23:25:34.644Z","attemptedAt":"2026-10-30T23:25:34.644Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-55612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55612","modified":"2026-10-30T22:16:54.950","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-30T23:25:34.849Z"}],"aiSummary":null}