{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-55612","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-06-16T23:31:22.445Z","datePublished":"2026-10-30T22:00:19.756Z","dateUpdated":"2026-10-30T22:00:19.756Z"},"containers":{"cna":{"title":"uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset","problemTypes":[{"descriptions":[{"cweId":"CWE-444","lang":"en","description":"CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"references":[{"name":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5","tags":["x_refsource_CONFIRM"],"url":"https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5"},{"name":"https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690","tags":["x_refsource_MISC"],"url":"https://github.com/openwrt/uhttpd/commit/34460b8211d676ef1b9f40d6b775c5e112933690"},{"name":"https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b","tags":["x_refsource_MISC"],"url":"https://github.com/openwrt/uhttpd/commit/b78f518478794e16ba3568fc1258e40bf3e8eb3b"}],"affected":[{"vendor":"openwrt","product":"uhttpd","versions":[{"version":">= b7c85a2819b3869279a669d5681f574824589c6c, < b78f518478794e16ba3568fc1258e40bf3e8eb3b","status":"affected"},{"version":">= b7c85a2819b3869279a669d5681f574824589c6c, < 34460b8211d676ef1b9f40d6b775c5e112933690","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-30T22:00:19.756Z"},"descriptions":[{"lang":"en","value":"uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue."}],"source":{"advisory":"GHSA-p55c-rmhc-qfm5","discovery":"UNKNOWN"}}}}