SWUpdate Integer Underflow Vulnerability in Multipart Upload Parser Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in SWUpdate versions through 2025.12. The issue arises from an integer underflow in the multipart upload parser within 'mongoose_multipart.c'. This vulnerability allows unauthenticated attackers to cause a denial-of-service by sending a crafted HTTP POST request to '/upload' with a malformed multipart boundary and controlled TCP stream timing. Exploitation triggers an integer underflow in the 'mg_http_multipart_continue_wait_for_chunk()' function, leading to an out-of-bounds heap read. This read writes data beyond the allocated receive buffer to a local IPC socket.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by disrupting the normal operation of the SWUpdate application, potentially leading to a crash or unresponsiveness.

Remediation

Users can upgrade to SWUpdate versions released after the vulnerability was patched in the 2025.12 version. The patch is available in the commit beee2dc on the SWUpdate GitHub repository.