CVE-2026-28525

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read past the allocated receive buffer to a local IPC socket.

CVSS 4.0

8.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-26)

CWEs

CWE-125, CWE-191

Published

2026-04-23

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• swupdate:swupdate

References

• https://github.com/sbabic/swupdate/commit/beee2dc0feef1cfe84f1aa6fc980e104b2e47a74
• https://www.vulncheck.com/advisories/swupdate-integer-underflow-in-multipart-upload-parser

Check your stackJSON