uhttpd: HTTP request smuggling via ubus POST body parse-error desync

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

uhttpd is a small HTTP server. In unpatched repository snapshots, uh_ubus_data_send() in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du->jsobj; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared Content-Length nor sets connection_close. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…uhttpd/security/advisories/GHSA-wgwp-64hh-f52p Diğer
• github.com/…ommit/7b1bec45826bd78c8afc993435bdc0f1df2fe399 Diğer
• github.com/…ommit/b2285de129b9adc8b12f84f9a27c16c21f2b57a5 Diğer

Kayıt geçmişi

1. 31 Eki 2026 00:57Yayımlandı

İlgili açıklar

• 6,9 CVE-2026-55614uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
• 3,7 CVE-2026-55612uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
• 4,8 CVE-2026-123318In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
• 2,9 CVE-2026-55458Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
• 3,7 CVE-2026-121441Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling
• 5,3 CVE-2026-121439Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http