EUVD-2026-25307
GHSA-hggv-rg65-qf4h
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable upload endpoint with no auth (AV:N/PR:N), but reliable triggering needs controlled TCP timing (AC:H); impact is availability-only DoS (A:H, C:N/I:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read that writes data beyond the allocated receive buffer to a local IPC socket.
AnalysisAI
Denial of service in SWUpdate (versions through 2025.12) allows unauthenticated remote attackers to crash the update service by sending a crafted HTTP POST to the /upload endpoint with a malformed multipart boundary and controlled TCP stream timing. An integer underflow in the bundled Mongoose multipart parser produces an out-of-bounds heap read that corrupts data written to a local IPC socket. No public exploit identified at time of analysis; EPSS is very low (0.03%) and CISA SSVC rates exploitation as none, but a vendor patch commit is available.
Technical ContextAI
SWUpdate is an embedded-Linux software update framework (typically integrated into Yocto/OpenEmbedded firmware images) that exposes an optional web/HTTP interface for uploading update artifacts. That interface reuses a vendored copy of the Mongoose embedded web server, and the flaw lives in mongoose_multipart.c within mg_http_multipart_continue_wait_for_chunk(). The root cause is CWE-191 (Integer Underflow): the code computes size_t data_len = io->len - (mp_stream->boundary.len + 8). Because data_len is an unsigned size_t, when the buffered input length io->len is smaller than boundary.len + 8, the subtraction wraps to a huge positive value, driving an out-of-bounds heap read whose data is then written past the receive buffer to the IPC socket. The upstream fix changes the subtracted constant from 8 to 6 in both the length calculation and the corresponding mg_iobuf_del() call, aligning the boundary-plus-delimiter accounting so the length can no longer underflow.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor patch commit beee2dc0feef1cfe84f1aa6fc980e104b2e47a74 (https://github.com/sbabic/swupdate/commit/beee2dc0feef1cfe84f1aa6fc980e104b2e47a74), which corrects the boundary length arithmetic in mongoose_multipart.c, and rebuild/reflash affected firmware images; track the sbabic/swupdate repository for the next tagged release incorporating this commit. As a compensating control until patched, disable the built-in web/HTTP upload interface if the device does not require remote update uploads, since this removes the vulnerable code path entirely at the cost of losing web-based updates. Where the interface must remain, restrict network access to the /upload endpoint via firewall rules or a reverse proxy so only trusted management hosts can reach it, and place the update service on an isolated management VLAN; these controls reduce reachability but do not fix the underflow itself. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/swupdate-integer-underflow-in-multipart-upload-parser) for details.
Same weakness CWE-191 – Integer Underflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today