No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 30 Oct 2026
- Last modified upstream: 05 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/openwrt/uhttpd/commit/7b1bec45826bd78c8afc993435bdc0f1df2fe399
- https://github.com/openwrt/uhttpd/commit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5
- https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p
- https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p
- Analysis, summary and remediation
- © VulnCrest