uhttpd: update to Git HEAD (2026-08-03)

f6c2fcfa539d client: cap cumulative header count and bytes per request
4f307a2156f3 client: verify chunk data is followed by CRLF before resyncing
628a073fef44 listen: set IP_FREEBIND so binding to a not-yet-present address works
0910904b75a3 client: reject empty chunk size lines in chunked transfer parsing
893fed8577d7 client: use strict chunk size parsing to fix issue #3
8867514f51fa client: fix parse_chunksize() return type and stale comment
daa5078b959b client: reject invalid header names to prevent request smuggling
69f9cabd0d7d http: use chartypes table consistently, drop ctype.h
003cd188b8f9 http: further consolidate character classification and header parsing
f682ccabee9e client: parse and discard chunked trailer sections, use enum chunked_state
e76736e5676f ubus: guard params type in uh_ubus_send_request()
42e30caa704e ubus: set d->free unconditionally to fix url_path leak
d6205aad6176 client: move unread-body guard into uh_request_done()
3c48b9e17d20 ubus: release client refcount on successful /ubus/subscribe
d0b89eb7c70b utils: strip trailing whitespace from header field-values
067466662368 file: dereference symlinks when looking up MIME type
c54ba119cf54 lua, ucode: use buffered stdio for script output
60f64bec40c8 tls: add SNI-based redirect support

This closes five published security advisories, three of them rated
high: an unauthenticated header-accumulation memory-exhaustion DoS,
an out-of-bounds write via ubus params type confusion, a url_path
leak, a CL.0 request smuggling desync and a leaked client refcount
that wedges the listener.

Fixes: https://github.com/openwrt/uhttpd/issues/3
Fixes: https://github.com/openwrt/uhttpd/issues/5
Fixes: https://github.com/openwrt/uhttpd/issues/10
Fixes: https://github.com/openwrt/uhttpd/issues/11
Fixes: https://github.com/openwrt/uhttpd/issues/14
Fixes: https://github.com/openwrt/uhttpd/issues/17
Closes: https://github.com/openwrt/uhttpd/issues/19
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-vhx4-3p5q-m59q
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-2mpg-6wp5-435p
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-83vv-qrc6-h3hx
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-c2wg-hcff-hqrm
Link: https://github.com/openwrt/uhttpd/security/advisories/GHSA-wvgh-cm54-q6f6
Link: https://github.com/openwrt/openwrt/pull/24680
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

diff --git a/package/network/services/uhttpd/Makefile b/package/network/services/uhttpd/Makefile
index 915baa07ab9a0cb44f6819d9d09bc2c001ed2eb7..8a2e5a6d5aaa98d98ba5bf3ed3e72f1d40f7ab0f 100644 (file)
--- a/package/network/services/uhttpd/Makefile
+++ b/package/network/services/uhttpd/Makefile
@@ -9,9 +9,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git
-PKG_SOURCE_DATE:=2026-06-16
-PKG_SOURCE_VERSION:=7b1bec45826bd78c8afc993435bdc0f1df2fe399
-PKG_MIRROR_HASH:=ee52821b04cc78f46875e9870b6ed41670606d6b90fb31b31312666c4ed809dd
+PKG_SOURCE_DATE:=2026-08-03
+PKG_SOURCE_VERSION:=60f64bec40c8113cf09815ec377761b1f4f95f22
+PKG_MIRROR_HASH:=702b8df1ba868db13ae93b28ddaa9c421bcbfa34e8633cae984029e7b50ec59f
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=ISC