uhttpd is a lightweight HTTP server used in OpenWrt. In unpatched versions, a JSON body sent to /ubus in a POST request can be fragmented across TCP segments. The first segment completes the JSON parsing, but a subsequent segment triggers a parse‑error path that consumes zero bytes. Because the remaining declared Content‑Length is not drained and the connection is not closed, the unread bytes are interpreted as a new HTTP request on the same persistent connection. This request smuggling flaw therefore allows an attacker to inject a second request into the transaction stream. The CVE description does not explicitly state the consequences, so the possibility of executing unintended commands or causing a denial‑of‑service is inferred from the nature of request smuggling vulnerabilities.

The vulnerability affects OpenWrt's uhttpd component whenever the ubus interface is enabled, which is the default in many builds. It also impacts deployments that use uhttpd as a proxy or CDN edge where ubus is exposed. No explicit version numbers are provided; the flaw exists in unpatched repository snapshots and is fixed by the referenced commits.

The CVSS score is 6.9, indicating medium severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. Based on the description, the attack vector is network‑based, requiring an attacker to send crafted POST /ubus requests that are split across multiple TCP segments over an HTTP/1.1 keep‑alive connection. While exploitation may not be trivial, the medium CVSS and the ability to manipulate request boundaries present a realistic risk for exposed ubus services.