Quick answers
- Is CVE-2026-55614 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55614 being exploited in the wild.
- How severe is CVE-2026-55614?
- Informational severity, published 30 October 2026.
- Which products and versions are affected?
- OpenWrt uhttpd.
- Is there a fix for CVE-2026-55614?
- Yes: fixed in Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55614 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-55614?
- Check whether you run OpenWrt Uhttpd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Commits ae015e099986ceace44975cb69629841a2d58d37 and 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837
Technical details
The vulnerability exists in the `client_parse_header()` function in `client.c`, which uses case-sensitive `strcmp()` to compare the Transfer-Encoding value against "chunked", violating RFC 9112 section 6.1's case-insensitive matching requirement. On keep-alive connections, a request with "Transfer-Encoding: Chunked" (or other mixed-case variants) is accepted without enabling chunked framing, leaving the declared body unread and allowing subsequent bytes to be interpreted as a new HTTP request. The fix replaces `strcmp()` with `strcasecmp()` and rejects unhandled transfer-coding tokens with a 501 response.
Affected products
- OpenWrt uhttpd
Timeline
- 2026-10-30: disclosed