Tinyproxy
CVE-2026-54388
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated smuggling via crafted headers (AV:N/AC:L/PR:N/UI:N); scope changes as the proxy mis-delivers requests to a separate backend authority (S:C); confidentiality and integrity of smuggled/poisoned traffic are high, availability not directly impacted.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
AnalysisAI
HTTP request smuggling in Tinyproxy through 1.11.3 allows remote unauthenticated attackers to desynchronize the proxy and its backend by sending requests with multiple Content-Length headers having differing values. Because Tinyproxy forwards all duplicate Content-Length headers while parsing only the first value, downstream servers may interpret request boundaries differently, enabling cache poisoning, access control bypass, and request hijacking. No public exploit identified at time of analysis, but the underlying primitive is well documented and the upstream commit 364cdb6 clearly demonstrates the parsing flaw.
Technical ContextAI
Tinyproxy is a lightweight forward HTTP/HTTPS proxy daemon commonly deployed as an egress gateway in embedded, containerized, and small-network environments (cpe:2.3:a:tinyproxy:tinyproxy:*). The vulnerability is a classic CWE-444 Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) caused by the header-handling logic in src/reqs.c, specifically add_header_to_connection() and process_client_headers(). The upstream patch (commit 364cdb6, merged via PR #610) rejects additional Content-Length headers once one is already stored and strips Content-Length when chunked Transfer-Encoding is also present, eliminating the parser-state divergence between Tinyproxy and the backend.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes in commit 364cdb6 (https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb) by upgrading to a build that includes the patch or by rebuilding from current main, since no tagged release beyond 1.11.3 is referenced in the input. If immediate patching is not possible, place Tinyproxy behind a strict HTTP-aware front-end (such as a hardened reverse proxy or WAF) configured to reject requests containing multiple Content-Length headers or simultaneous Content-Length and Transfer-Encoding: chunked, accepting the trade-off that this adds an extra hop and that some legitimate but quirky clients may be blocked. Additionally, restrict who can reach the proxy by binding it to trusted interfaces or enforcing network-layer ACLs, recognizing this only reduces exposure rather than fixing the parsing flaw.
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used.
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.
HTTP request smuggling in Tinyproxy through 1.11.3 lets remote unauthenticated attackers desynchronize the proxy and bac
Authentication bypass in Tinyproxy through 1.11.3 lets unauthenticated remote attackers reach the internal statistics pa
Remote denial of service in tinyproxy versions through 1.11.3 allows unauthenticated attackers to exhaust all proxy work
HTTP request smuggling and denial of service in Tinyproxy through 1.11.3 allows unauthenticated remote attackers to caus
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-roo
Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today