CVE-2026-55613

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.

• CWE-444

• https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399
• https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5
• https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p
• https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p

Published

Oct 30, 2026

Last Modified

Nov 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55608n8n-MCP is an MCP server that provides AI assistants access …5.4
• CVE-2026-55609sublinear-time-solver is a Rust and WebAssembly library for …7.1
• CVE-2026-5561A vulnerability was determined in Campcodes Complete POS Man…6.3
• CVE-2026-55610InvoiceShelf is an open-source web & mobile app that helps t…8.7
• CVE-2026-55611AnythingLLM is an application that turns pieces of content i…0
• CVE-2026-55612uhttpd is a small HTTP server. In unpatched repository snaps…3.7
• CVE-2026-55614uhttpd is a small HTTP server. In unpatched repository snaps…6.9
• CVE-2026-55615Langroid is a framework for building large-language-model-po…9.2
• CVE-2026-55616Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-55617Hydro is a next-generation high-performance online judge pla…6.9
• CVE-2026-55618eml_parser serves as a python module for parsing eml files a…6.5
• CVE-2026-55619eml_parser serves as a python module for parsing eml files a…5.3