Quick answers
- Is CVE-2026-55613 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55613 being exploited in the wild.
- How severe is CVE-2026-55613?
- Informational severity, published 30 October 2026.
- Which products and versions are affected?
- OpenWrt uhttpd.
- Is there a fix for CVE-2026-55613?
- Yes: fixed in Commits 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55613 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-55613?
- Check whether you run OpenWrt Uhttpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Commits 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5
Technical details
The `uh_ubus_data_send()` function in ubus.c fails to properly drain remaining Content-Length bytes when a JSON POST body parse error occurs on a segmented TCP stream. When a complete JSON object is already parsed or the body exceeds size limits, the handler returns zero bytes consumed without closing the connection, allowing the unread body suffix to be interpreted as a new HTTP request on the same keep-alive connection. This is a request smuggling vulnerability distinct from Transfer-Encoding issues, exploitable over the network against deployments with ubus enabled.
Affected products
- OpenWrt uhttpd
Timeline
- 2026-10-30: disclosed