OpenWrt uhttpd CVE-2026-55612

Exploitation requires the uhttpd instance to accept HTTP keep-alive (persistent) connections and to process chunked transfer-encoding POST bodies, which is default behavior in affected unpatched repository snapshots. The attacker must send a chunked POST containing a valid initial chunk and then an invalid chunk-length line whose value exceeds INT_MAX (e.g. hexadecimal 80000000) to trigger the invalid-chunk branch in client_poll_post_data(), with a byte-aligned complete second HTTP request embedded in the remaining body. No authentication is needed (CVSS PR:N). Limiting factors: AC:H reflects that the attacker must precisely frame the embedded request so it aligns as a clean second request after the state reset; and in practice uhttpd commonly serves a router/device management interface that is not internet-exposed by default, so real-world reach is often confined to the LAN or to deployments where uhttpd shares a connection path with a proxy or cache. Affected: unpatched snapshots before the fix commits; fixed by setting request.connection_close on the invalid-chunk path.

Signals conflict sharply and must be reconciled before prioritization. The supplied NVD CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) yields only 3.7 (Low) and treats the flaw as a network-reachable, unauthenticated issue of high attack complexity with limited integrity impact and no confidentiality or availability impact; the GitHub Security Advisory (GHSA-p55c-rmhc-qfm5), by contrast, self-rates the same bug as High (~8.1) - a large, unresolved discrepancy that security teams should note rather than treat as settled. The vuln.today decision label is 'monitor', consistent with the low NVD score and with the absence of CISA KEV listing and any supplied EPSS probability (both EPSS and KEV data are simply not provided in the input, so exploitation likelihood cannot be quantified from these sources). There is no SSVC decision content beyond the 'monitor' label. On exploit maturity: the GHSA advisory contains concrete reproduction steps and a mechanism-level description, so a public PoC reference exists, but the input does not mark it as confirmed working exploit code - treat it as a documented technique, not a verified weaponized exploit. Net read: this is a genuine request-smuggling/desync defect with a clear root cause and confirmed fix, but AC:H plus the typical LAN-only exposure of uhttpd's management interface make widespread opportunistic exploitation unlikely; the practical ceiling depends heavily on whether a given uhttpd instance sits behind a shared proxy/cache or serves multiple clients. The NVD-vs-GHSA severity gap is the single most important caveat - do not present either score as authoritative without vendor confirmation.

A remote attacker opens an HTTP keep-alive connection to an unpatched uhttpd instance and sends a chunked POST whose body contains a valid first chunk followed by an oversized chunk-length line (e.g. 80000000) that trips the invalid-chunk branch; the server clears its chunked/content-length state without draining or closing, then re-parses the attacker's embedded 'GET /target HTTP/1.1' as a second request on the same socket. This yields request-boundary desynchronization and smuggling, which is most impactful when uhttpd shares the connection path with a proxy, cache, or multiple clients. A public PoC reference with reproduction steps exists in the GHSA advisory; it is not verified as standalone working exploit code, and the high attack complexity (AC:H) reflects the precise framing the body must achieve.