OpenWrt 25.12.6 fixes remote uhttpd flaws on default installs

OpenWrt 25.12.6 is out, and the project is strongly recommending the upgrade. The sixth service release in the 25.12 stable series closes several remotely triggerable vulnerabilities in core network services that are enabled by default on typical installs.

The bulk of the urgency sits in uhttpd, the lightweight web server that ships enabled with LuCI. It was bumped to a build that addresses multiple published advisories, all reachable without authentication. CVE-2026-102338 (High) is a memory-exhaustion denial of service from an unlimited number of HTTP request headers. Other High-rated issues include an out-of-bounds write from type confusion on the params field of POST /ubus/call/ requests, and unbounded memory growth from a URL path leak on every non-POST /ubus request. Moderate findings cover HTTP request smuggling (CL.0) when a keep-alive connection was reused with an unread body, and a leaked client reference on /ubus/subscribe/ that could permanently block the listener. A further High issue failed to enforce Basic Auth realms for Lua and ucode handlers under a configured URL prefix; that one matters only where Basic Auth realms are actually set up.

The release also moves the default TLS library, Mbed TLS, to 3.6.7.

Forum reports so far include clean upgrades on several consumer boards. One user said a pair of Linksys MX5500 units came up with dead ethernet ports and only Wi-Fi working after the jump.