CVE-2026-54388
Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 17, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 12, 2026
Description
Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected Products
| Product | Versions |
|---|---|
tinyproxytinyproxy |
|
References
- Researcher Pull Requestissue-tracking
- Maintainer Pull Requestissue-tracking
- Patch Commitpatch
- https://www.vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-duplicate-content-length-headersthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.