uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

uhttpd is a small HTTP server. In unpatched repository snapshots, client_parse_header() in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r->transfer_chunked, despite transfer-coding tokens being case-insensitive. On a keep-alive connection, the chunked POST body is left unread and request-shaped body bytes are parsed as another HTTP request, permitting HTTP request smuggling and boundary desynchronization. Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 patch the issue.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf Diğer
• github.com/…ommit/6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 Diğer
• github.com/…ommit/ae015e099986ceace44975cb69629841a2d58d37 Diğer

Kayıt geçmişi

1. 31 Eki 2026 01:01Yayımlandı

İlgili açıklar

• 3,7 CVE-2026-55612uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
• 6,9 CVE-2026-55613uhttpd: HTTP request smuggling via ubus POST body parse-error desync
• 4,8 CVE-2026-123318In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine
• 2,9 CVE-2026-55458Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
• 3,7 CVE-2026-121441Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling
• 5,3 CVE-2026-121439Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http