]> git.ipfire.org Git - thirdparty/openwrt.git/commit
uhttpd: update to Git HEAD (2026-08-03) 24680/head
authorHauke Mehrtens <hauke@hauke-m.de>
Tue, 11 Aug 2026 20:46:05 +0000 (22:46 +0200)
committerHauke Mehrtens <hauke@hauke-m.de>
Thu, 13 Aug 2026 00:22:54 +0000 (02:22 +0200)
commit80de19ea3b6e34dd60c9e0f76f5b3a781331822d
tree31c1c73f3683d972085bb1e007107df2551df5ee
parent6e20811dfe788badbe2d2dd5b157052d99e5170d
uhttpd: update to Git HEAD (2026-08-03)

f6c2fcfa539d client: cap cumulative header count and bytes per request
4f307a2156f3 client: verify chunk data is followed by CRLF before resyncing
628a073fef44 listen: set IP_FREEBIND so binding to a not-yet-present address works
0910904b75a3 client: reject empty chunk size lines in chunked transfer parsing
893fed8577d7 client: use strict chunk size parsing to fix issue #3
8867514f51fa client: fix parse_chunksize() return type and stale comment
daa5078b959b client: reject invalid header names to prevent request smuggling
69f9cabd0d7d http: use chartypes table consistently, drop ctype.h
003cd188b8f9 http: further consolidate character classification and header parsing
f682ccabee9e client: parse and discard chunked trailer sections, use enum chunked_state
e76736e5676f ubus: guard params type in uh_ubus_send_request()
42e30caa704e ubus: set d->free unconditionally to fix url_path leak
d6205aad6176 client: move unread-body guard into uh_request_done()
3c48b9e17d20 ubus: release client refcount on successful /ubus/subscribe
d0b89eb7c70b utils: strip trailing whitespace from header field-values
067466662368 file: dereference symlinks when looking up MIME type
c54ba119cf54 lua, ucode: use buffered stdio for script output
60f64bec40c8 tls: add SNI-based redirect support

This closes five published security advisories, three of them rated
high: an unauthenticated header-accumulation memory-exhaustion DoS,
an out-of-bounds write via ubus params type confusion, a url_path
leak, a CL.0 request smuggling desync and a leaked client refcount
that wedges the listener.

Fixes: https://github.com/openwrt/uhttpd/issues/3
Fixes: https://github.com/openwrt/uhttpd/issues/5
Fixes: https://github.com/openwrt/uhttpd/issues/10
Fixes: https://github.com/openwrt/uhttpd/issues/11
Fixes: https://github.com/openwrt/uhttpd/issues/14
Fixes: https://github.com/openwrt/uhttpd/issues/17
Closes: https://github.com/openwrt/uhttpd/issues/19
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-vhx4-3p5q-m59q
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-2mpg-6wp5-435p
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-83vv-qrc6-h3hx
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-c2wg-hcff-hqrm
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-wvgh-cm54-q6f6
Link: https://github.com/openwrt/openwrt/pull/24680
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
package/network/services/uhttpd/Makefile