PT-2026-34748 · Sbabic · Swupdate

Vulncheck · Published 2026-04-23 · Updated 2026-04-23 · CVE-2026-28525

NVD

CVSS v3.1

6.8

Medium

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg http multipart continue wait for chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read that writes data beyond the allocated receive buffer to a local IPC socket.

Fix

Out of bounds Read

Integer Underflow

Weakness Enumeration

CWE-125

CWE-191

Related Identifiers

CVE-2026-28525

Affected Products

Swupdate

References · 3

• https://github.com/sbabic/swupdate/commit/beee2dc0feef1cfe84f1aa6fc980e104b2e47a74 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28525 · Security Note
• https://vulncheck.com/advisories/swupdate-integer-underflow-in-multipart-upload-parser · Note