HTTP Chunked Parser CVE-2026-52056

MEDIUM

2026-08-13 vendor:ubuntu

Severity by source

vuln.today AI

6.5 MEDIUM

Network-reachable HTTP parser, no auth required for chunked requests; OOB read yields only disclosure or DoS, no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 17:39 vuln.today

DescriptionCVE.org

[skip_chunk off-by-one OOB read in chunked HTTP CRLF check]

AnalysisAI

Off-by-one out-of-bounds read in an HTTP chunked transfer encoding parser - specifically in the CRLF check within a skip_chunk code path - affects software distributed via Ubuntu. The flaw allows network-accessible parsing code to read one byte past a valid buffer boundary when processing chunked HTTP request or response data. Depending on memory layout, this may yield information disclosure or a process crash; no public exploit has been identified at time of analysis and no CVSS vector is available to further qualify scope.

Technical ContextAI

HTTP/1.1 chunked transfer encoding uses CRLF (carriage-return/line-feed, \r\n) delimiters to mark chunk boundaries. A parser must advance through each chunk header, data, and trailing CRLF precisely. The reported function 'skip_chunk' appears to iterate over chunked data to locate or validate the CRLF terminator. An off-by-one error in the boundary check means the read index increments one position beyond the allocated buffer before the bounds guard fires, constituting a heap or stack OOB read (CWE-125 class). No CWE is formally assigned in the available data, but the description maps clearly to CWE-125 (Out-of-bounds Read). No CPE string was provided; the affected package is identified only as distributed through Ubuntu, so the underlying upstream project (e.g., a web server, reverse proxy, or HTTP library) is not confirmed from available data.

Affected ProductsAI

The affected product is not precisely identified in the available data beyond being reported by the Ubuntu vendor security team. No CPE string, upstream project name, or version range is provided. Practitioners should consult Ubuntu Security Notices (usn.ubuntu.com) and search for CVE-2026-52056 to identify the specific Ubuntu package, version, and affected release series. Affected versions are not independently confirmable from this dataset.

RemediationAI

Consult the Ubuntu Security Notice (USN) corresponding to CVE-2026-52056 at usn.ubuntu.com for the specific package name and patched version. Apply the updated package via standard Ubuntu package management ('apt-get update && apt-get upgrade'). No exact fix version is available in this dataset, so the patch status cannot be independently confirmed here - do not assume a patch is available until confirmed via the Ubuntu USN tracker. As a compensating control while awaiting a patch, consider placing a Web Application Firewall or reverse proxy in front of affected services configured to reject malformed chunked encoding headers, though this may break legitimate chunked uploads and should be tested carefully in staging before production deployment.