PT-2026-134224
CVE-2026-55613
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
uhttpd (affected versions not specified)
Description
A flaw in the application-layer body-handler occurs when a
POST /ubus request arrives in multiple TCP segments. The function uh ubus data send() in ubus.c can desynchronize HTTP request boundaries if an initial segment completes a JSON object, causing subsequent segments to trigger a parse-error path that returns zero bytes consumed. Because the caller does not drain the remaining Content-Length or set connection close, any HTTP request embedded in the unread body suffix is processed as a new request on the same keep-alive connection. This issue affects deployments with ubus enabled, such as default OpenWrt configurations and certain proxy or CDN deployments.Recommendations
Apply repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5.
As a temporary mitigation, restrict access to the
/ubus endpoint. Found an issue in the description? Have something to add? Feel free to write us 👾