The vulnerability arises when the HTTP server lowercases header names but performs a case-sensitive comparison of the Transfer-Encoding value against the literal string "chunked". A request that supplies a mixed‑case token (for example, "ChaNKeD") is treated as a normal header while the transfer coding flag is never set. On a keep‑alive connection the following POST body is interpreted as another HTTP request, which enables an attacker to smuggle a second request into the stream and cause boundary desynchronization. The attacker can then inject malicious commands or exfiltrate data, leading to remote code execution or denial of service depending on the server’s capabilities. The weakness is a classic input validation flaw (CWE‑444).

The issue affects the uhttpd web server bundled with OpenWrt. Any installation of uhttpd that has not incorporated the fixes from commits ae015e099986ceace44975cb69629841a2d58d37 or 6641b050e5f7c7fd9ae92e8e119d6d6dfc6e9837 is vulnerable. The affected product is the uhttpd component of the OpenWrt firmware.

The CVSS score of 6.9 represents moderate severity; the EPSS score is not available, so the exploitation probability is currently uncertain. The vulnerability is not listed in CISA KEV, indicating no confirmed exploits in the wild at the time of analysis. Likely attack vectors involve remote clients connecting over HTTP/HTTPS to the OpenWrt device. An attacker could craft a mixed‑case Transfer‑Encoding header over a persistent connection to smuggle an arbitrary second request, potentially gaining elevated privileges or compromising services running behind the device.