uhttpd CVE-2026-55614

Exploitation requires a keep-alive (persistent) connection on which the attacker sends a Transfer-Encoding header with a mixed-case transfer-coding token (e.g. 'Chunked') plus a chunked-shaped body and a pipelined follow-on request. No non-default server configuration, authentication, or user interaction is needed - the flaw is in uhttpd's default header-parsing path, so default deployments that accept POST bodies over keep-alive are affected. Limiting factors: the attacker must control raw request framing (a direct client, not forced through a normalizing proxy that rewrites the header), the connection must be keep-alive rather than Connection: close, and the resulting impact is request smuggling / boundary desynchronization (integrity) rather than direct disclosure or denial of service per the supplied vector.

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity flaw with no special attack requirements, and the source diff confirms the mechanism precisely: client_parse_header() compares the Transfer-Encoding value with case-sensitive strcmp(val, "chunked"), so a mixed-case 'Chunked' token bypasses chunked framing and leaves the POST body unread on a keep-alive connection. The official CVSS 4.0 score is 6.9 with impact limited to VI:L (low integrity, no confidentiality or availability), whereas the GHSA advisory estimates CVSS 3.1 ~8.1 (High) - these two figures conflict and should be treated as a known discrepancy; the lower NVD-style 4.0 figure is the one tied to the supplied vector. No EPSS score was provided and the input shows no CISA KEV listing, so there is no evidence of active exploitation; the vuln.today decision label is 'this_month', consistent with a serious-but-not-urgent classification. A detailed, reproducible PoC narrative is published in the GHSA advisory, which raises likelihood of exploitation above a purely theoretical flaw. Net: prioritize patching within the normal monthly cycle given the easy remote trigger and the broad OpenWrt footprint, but the impact is request desynchronization rather than direct code execution or data compromise.

An attacker opens a single keep-alive TCP connection to a uhttpd server and sends a POST carrying 'Transfer-Encoding: Chunked' (capital C) with a chunked body, immediately followed by a pipelined request. Because the mixed-case token is not matched as chunked, r->transfer_chunked stays false, the body is never consumed, and the server reparses the leftover body bytes as a second HTTP request - enabling request smuggling and connection boundary desync. A public PoC reference with reproduction steps exists in the GHSA advisory, though it is not verified as working exploit code; the low attack complexity and lack of required privileges or user interaction make the trigger straightforward.