Which versions of Tinyproxy are affected by CVE-2026-54387?

Tinyproxy versions up to 1.11.3 contain a critical HTTP request smuggling vulnerability allowing unauthenticated remote attackers to bypass proxy defenses and desynchronize requests to backend…. A patch is available.

How to fix or mitigate CVE-2026-54387?

Within 24 hours: Identify all systems running Tinyproxy 1.11.3 or earlier and assess their exposure and role in request handling. Within 7 days: Apply vendor-released patch per advisory and upgrade all Tinyproxy instances to the patched version. Within 30 days: Validate all patches are deployed, conduct security testing of proxy functionality and backend access controls, and review proxy logs for exploitation attempts.

Tinyproxy CVE-2026-54387

Q: What is the CVSS score of CVE-2026-54387?

CVE-2026-54387 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

CRITICAL

HTTP Request/Response Smuggling (CWE-444)

2026-06-17 VulnCheck

Authentication Bypass Request Smuggling Tinyproxy

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Network-reachable proxy, no auth or user interaction, low complexity; smuggling crosses a trust boundary into the backend so Scope:Changed, with high confidentiality/integrity impact and no availability hit.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 20:30 vuln.today

Analysis Generated

Jun 17, 2026 - 20:30 vuln.today

DescriptionCVE.org

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

AnalysisAI

HTTP request smuggling in Tinyproxy through 1.11.3 lets remote unauthenticated attackers desynchronize the proxy and backend by sending requests carrying both Content-Length and Transfer-Encoding: chunked headers. Tinyproxy forwards both headers verbatim while parsing the body using Content-Length, producing a classic CL.TE desync that enables cache poisoning, access control bypass, and request hijacking against the backend. No public exploit identified at time of analysis, though VulnCheck has published an advisory and the upstream issue/PR describe the bug in detail.

Technical ContextAI

Tinyproxy is a small, widely-deployed lightweight HTTP/HTTPS forward proxy commonly used in embedded devices, container egress gateways, and constrained Linux environments (CPE cpe:2.3:a:tinyproxy:tinyproxy:*). The root cause is CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling): RFC 7230 requires intermediaries that see both Content-Length and Transfer-Encoding to either reject the message or strip Content-Length, but Tinyproxy's request handling in src/reqs.c did neither - it forwarded both framing headers to the backend while internally consuming bytes according to Content-Length. The upstream fix (commit ff45d3b, PR #610) now refuses duplicate Content-Length headers in add_header_to_connection and, in process_client_headers, removes Content-Length whenever Transfer-Encoding: chunked is also present, aligning Tinyproxy's framing decision with that of the backend.

RemediationAI

Upstream fix available (PR #610 / commit ff45d3b); released patched version not independently confirmed, so operators should either build Tinyproxy from a tree containing commit ff45d3bf0e61d0f8ed97ab379d3047f04eb67521 or wait for and install a distribution package that backports it (track https://github.com/tinyproxy/tinyproxy/pull/610 and the VulnCheck advisory). As a temporary compensating control, place a smuggling-aware reverse proxy or WAF in front of Tinyproxy and configure it to reject requests that carry both Content-Length and Transfer-Encoding headers - accepting the operational cost that some legacy clients sending both headers will be blocked. Where Tinyproxy is used purely as an outbound forward proxy from trusted clients, restrict its listening interface to localhost or a management VLAN via the Listen and Allow directives in tinyproxy.conf so untrusted networks cannot reach it; this breaks any intentional public-proxy use case. Avoid relying on the backend alone to detect the desync, since the whole class of CL.TE attacks exists precisely because front and back disagree.