CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-coding token is accepted without enabling `r->transfer_chunked`, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the `chunked` POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.

• CWE-444

• https://github.com/openwrt/uhttpd/commit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837
• https://github.com/openwrt/uhttpd/commit/ae015e099986ceace44975cb69629841a2d58d37
• https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf

Published

Oct 30, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55609sublinear-time-solver is a Rust and WebAssembly library for …7.1
• CVE-2026-5561A vulnerability was determined in Campcodes Complete POS Man…6.3
• CVE-2026-55610InvoiceShelf is an open-source web & mobile app that helps t…8.7
• CVE-2026-55611AnythingLLM is an application that turns pieces of content i…0
• CVE-2026-55612uhttpd is a small HTTP server. In unpatched repository snaps…3.7
• CVE-2026-55613uhttpd is a small HTTP server. In unpatched repository snaps…6.9
• CVE-2026-55615Langroid is a framework for building large-language-model-po…9.2
• CVE-2026-55616Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-55617Hydro is a next-generation high-performance online judge pla…6.9
• CVE-2026-55618eml_parser serves as a python module for parsing eml files a…6.5
• CVE-2026-55619eml_parser serves as a python module for parsing eml files a…5.3
• CVE-2026-5562A vulnerability was identified in provectus kafka-ui up to 0…9.8