CVE-2026-28525 SWUpdate Integer Underflow in Multipart Upload Parser
Unauthenticated attackers can cause a denial of service in SWUpdate by sending crafted HTTP requests that trigger an integer underflow and out-of-bounds read.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28525?
CVE-2026-28525 is a high-severity vulnerability in sbabic swupdate, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read past the allocated receive buffer to a local IPC socket.
Which versions are affected by CVE-2026-28525?
It affects 1 product.
Products include Swupdate Swupdate.
How do I fix CVE-2026-28525?
Apply the vendor's patch.
Is CVE-2026-28525 being exploited?
There is no known exploitation of CVE-2026-28525 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-28525, GHSA-hggv-rg65-qf4h, UBUNTU-CVE-2026-28525.