The flaw in the uhttpd HTTP server allows an attacker to craft a POST request with an invalid chunk-size line exceeding the maximum signed integer value. When the server consumes this malformed line, it clears its internal content length and chunked transfer flags without draining the body or signaling the connection to close. The parser then believes the chunked request is finished, resets to the initial client state, and interprets the remaining request body as a new, separate HTTP request. This results in request smuggling and desynchronization, potentially enabling malicious payloads to be injected into subsequent requests or bypassing security controls. The weakness is a flaw in input validation and parsing (CWE-444).

The vulnerable code is part of the openwrt uhttpd component. Any OpenWrt installation running a uhttpd version prior to the two commits referenced in the advisory (b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690) is affected. The affected versions are those whose repository snapshots contain the unpatched code. Users should verify that their deployed uhttpd package is updated beyond these commits.

The CVSS score of 3.7 categorizes this as a low severity vulnerability. The EPSS score is currently not available, and the CVE is not listed in the CISA KEV catalog, indicating no publicly known exploitation. However, the likelihood that an attacker can reach the vulnerable server over an open network connection is high, so the attack vector is inferred to be remote network via HTTP. Exploitation requires sending a specially crafted request, which does not need privileged local access. Because the issue can lead to request smuggling, an attacker could hijack the connection to inject malicious requests or bypass authentication, but such exploitation would likely be limited by the low CVSS. Nevertheless, the attack is possible if the server remains exposed.