CVE-2026-54387
Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 17, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 12, 2026
Description
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected Products
| Product | Versions |
|---|---|
tinyproxytinyproxy |
|
References
- Researcher Pull Requestissue-tracking
- Maintainer Pull Requestissue-tracking
- Patch Commitpatch
- https://www.vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-cl-te-desynchronizationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.