-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2026-019
Product:                   uHTTPd
Manufacturer:              OpenWrt
Affected Version(s):       506e249
Tested Version(s):         506e249
Vulnerability Type:        CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') 
Risk Level:                High
Solution Status:           Fixed
Manufacturer Notification: 2026-04-07
Solution Date:             2026-04-16 
Public Disclosure:         2026-07-16
CVE Reference:             Not yet assigned
Author of Advisory:        Nicola Staller, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The manufacturer describes the product as follows (see [1]):

"uHTTPd is OpenWrt's default web server and is used to provide the LuCI web
interface."

Due to parsing content length values incorrectly, uHTTPd is vulnerable to
HTTP request smuggling.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

OpenWrt uHTTPd interprets a content length value with a leading zero as an
octal number, which leads to HTTP request smuggling if used with a front end
such as a proxy or reverse proxy. RFC-compliant proxies interpret the content
length as a decimal number in contrast to OpenWrt uHTTPd.
This discrepancy enables HTTP request smuggling.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

Send an HTTP request with a Content-Length header such as the following.
Note that line breaks are represented by the textual escape sequence "\r\n":

POST / HTTP/1.1\r\n
Host: <HOST>\r\n
Connection: keep-alive\r\n
Content-Length: 025\r\n
\r\n
test=AAAAAAAAAAAAAAAABBBB

Observe that OpenWrt uHTTPd only reads the first 21 bytes of the body (up to
the first "B") due to interpreting the content length as an octal number.
This leads to HTTP request smuggling if used in conjunction with a front end
(e.g. reverse proxy, load balancer, etc.) since a compliant front end will
interpret the length as a decimal number. The front end forwards the whole
body, while OpenWrt uHTTPd reads in only a part of it, with the unread bytes
poisoning the connection and influencing follow-up requests.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Update to a software version newer than the commit e619cb0. 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2026-03-19: Vulnerability discovered
2026-04-07: Vulnerability reported to manufacturer
2026-04-16: Patch released by manufacturer
2026-07-16: Public disclosure of vulnerability


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for OpenWrt uHTTPd
    https://openwrt.org/docs/guide-user/services/webserver/http.uhttpd
[2] SySS Security Advisory SYSS-2026-019
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-019.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Nicola Staller and Manuel Hammer
of SySS GmbH.

E-Mail: nicola.staller@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Nicola_Staller.asc
Key ID: 0x9DF339F941DD2290
Key Fingerprint: A127 394A F398 B097 2332  637C 9DF3 39F9 41DD 2290 

E-Mail: manuel.hammer@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Manuel_Hammer.asc
Key ID: 0xDA884B1D2510A3BC
Key Fingerprint: C6CA EC55 298E 2B68 28BF  D39E DA88 4B1D 2510 A3BC 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoSc5SvOYsJcjMmN8nfM5+UHdIpAFAmpXSwkACgkQnfM5+UHd
IpD7kw//f0F9zpqCCCTbUrxf+gNb01bWkHjn+emZzQggYhq/k/IGAffms2UlrOxh
KhR71LkI+MCwiYsyw1dCPNvheNE1wXqtF2gsdpUEG07aAsoMuwhuCxtngmJyADux
3xpKHTVz6lSwyb3lqI0Odr9DDs60EWo/yHSWruORkzeDzi1HYhbK6LSe6hhA2Fpw
lGqa710b7QNioyvrtsX6xkvmz1YXhz/5kxPKl3e9CPUrx/4fE1zwIt78aeked4jl
pV5cQeBQCkLoRUF5nBgbdZ/rhCj0ki20q+v7GjLVNYIDzhrANwvQXLU1lBXKHlfv
uRdsHClzyZwkjTza9AoeWd64qcrDtUH+8Bw7rkveNYyc/hArdL9/0czcniYHgdZh
aLzLxcvOGQ8obZUUHBtJXJgigxO9f++iWvwzxbFQG33WrvoYMGmWzAShDS/SIN9l
2J3DH+JewF+udHhazgIX+EbRNE57Ql0JCnBOb8brDYsqSG5EH0au4F8vVVdpo3QZ
OnebYzDF7c4yOYWu2M4AWkkrHw5tC+isWRYhUZnTgLaXUa4ZOuJu4bDwj0GP58CG
6NLGpyySvGg4Bs0Nf6JxgajoWeYHGQG2er4RQzjF6MHlqSKL7kiadM+USFtbeUf2
jYG6ETzg1Yj0atwaQzoMnV+9XKm/X6Afjsh99KE0e05Ieh3qDN0=
=Go0L
-----END PGP SIGNATURE-----