Product
3 published CVES affecting openwrt uhttpd, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
uhttpd is a small HTTP server. In unpatched repository snapshots, client_parse_header() in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r->transfer...
uhttpd is a small HTTP server. In unpatched repository snapshots, client_poll_post_data() in client.c consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears r->content_length and r->transfer_chunked without draining the remaining body or setting requ...
uhttpd is a small HTTP server. In unpatched repository snapshots, uh_ubus_data_send() in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du->jsobj; a later segment take...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.