CVE-2026-55614

Name of the Vulnerable Software and Affected Versions uhttpd (affected versions not specified)

Description The client parse header() function in client.c lowercases header names but uses a case-sensitive strcmp to compare the Transfer-Encoding value to chunked. Because transfer-coding tokens are case-insensitive, a mixed-case token is accepted without enabling r->transfer chunked. On a keep-alive connection, the chunked POST body remains unread, causing request-shaped body bytes to be parsed as a subsequent HTTP request. This leads to HTTP request smuggling and boundary desynchronization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.