Log in Start free

Vulnerability · Published Jun 17, 2026 · Assigned by VulnCheck

CVE-2026-54387Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

Critical 9.1

In plain English

A critical-severity security flaw in tinyproxy from tinyproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.4%top 61.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tinyproxyno fix listedDEBIAN-CVE-2026-54387
Debian:13tinyproxyno fix listedDEBIAN-CVE-2026-54387
Debian:14tinyproxyno fix listedDEBIAN-CVE-2026-54387
Ubuntu:24.04:LTStinyproxyno fix listedUBUNTU-CVE-2026-54387
Ubuntu:25.10tinyproxyno fix listedUBUNTU-CVE-2026-54387
Ubuntu:26.04:LTStinyproxyno fix listedUBUNTU-CVE-2026-54387
Ubuntu:26.10tinyproxyno fix listedUBUNTU-CVE-2026-54387

Affected products (as reported)

VendorProductVersions
tinyproxy tinyproxy 0 – through 1.11.3

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References