CVE-2026-55612

Name of the Vulnerable Software and Affected Versions uhttpd (affected versions not specified)

Description The client poll post data() function in client.c fails to properly handle invalid chunk-length lines, such as sizes exceeding INT MAX. When this occurs, the server clears r->content length and r->transfer chunked without draining the remaining body or setting request.connection close. This causes the completion check to incorrectly treat the chunked POST as finished, returning the keep-alive parser to CLIENT STATE INIT. Consequently, attacker-controlled body bytes formatted as a complete HTTP request are parsed and processed as a separate request on the same connection, leading to HTTP request smuggling and request-boundary desynchronization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.