Tinyproxy CVE-2026-54387

Attacker needs only network reachability to a Tinyproxy listener (any version up to and including 1.11.3) that forwards to a backend; per CVSS PR:N/UI:N/AT:N the attack is unauthenticated, requires no user interaction, and works against default Tinyproxy configurations because the header-reconciliation flaw is in core request handling, not behind an optional feature. Real-world impact is gated by what lives behind the proxy: the backend must itself treat Transfer-Encoding: chunked authoritatively (the standard behavior) so that it disagrees with Tinyproxy's Content-Length-based framing, and the smuggled request must reach something worth attacking - an authenticated app, a shared cache, or an ACL-protected endpoint. Deployments where Tinyproxy is bound to localhost or a trusted management network, or where it only fronts static unauthenticated content, materially limit exploitability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) of 9.3 Critical is consistent with the description: any reachable Tinyproxy instance can be hit with crafted HTTP requests, no authentication, no user interaction, with high confidentiality and integrity impact on smuggled-to backends and zero availability impact (a desync rarely DoSes the proxy itself). However, real-world impact depends heavily on what sits behind Tinyproxy - a desync is only valuable if the backend serves authenticated users, caches responses, or enforces ACLs that can be bypassed; egress-only deployments fronting outbound traffic gain little for attackers. The vulnerability is not in CISA KEV and no EPSS score is provided, and no public PoC URL is included in the references, so exploitation is currently theoretical-but-credible: the bug class is well-understood by attackers, VulnCheck has published an advisory, and the upstream patch diff plus issue #609 effectively document the trigger, lowering the bar to weaponization.

An attacker reachable to a Tinyproxy listener sends a single HTTP request containing a Content-Length header sized to cover only the visible request, plus a Transfer-Encoding: chunked header whose body smuggles a second hidden request (for example, a POST to an admin endpoint or a request that poisons a downstream cache key). Tinyproxy consumes only Content-Length bytes and forwards the full payload, so the backend treats the trailing bytes as the next pipelined request from a trusted source, allowing the attacker to hijack a victim's session, bypass IP/path ACLs, or poison a shared cache. No public exploit identified at time of analysis, but the upstream issue and patch effectively document the trigger.