Every CVE Search/ Get API key

CVE-2026-54387

Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

9.3 Critical

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.44%Up 0.1 points since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.3

Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Record
CVE-2026-54387
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2026-37789 9.3

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Record
EUVD-2026-37789
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9667-7p67-2364 9.3

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length...

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Record
GHSA-9667-7p67-2364
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-444
Updated
2026-11-02
NVD 9.3

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Record
CVE-2026-54387
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-444
Updated
2026-11-02
OSV 9.3

Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Record
CVE-2026-54387
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-444
Updated
2026-11-02
OSVDEBIAN-CVE-2026-54387 9.3

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Record
DEBIAN-CVE-2026-54387
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-54387 9.3

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Record
UBUNTU-CVE-2026-54387
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:11060-1 No score

tinyproxy-1.11.3-3.1 on GA media

These are all security issues fixed in the tinyproxy-1.11.3-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11060-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22133-1 No score

Security update for tinyproxy

This update for tinyproxy fixes the following issues:

Changes in tinyproxy:

  • Fixed failure to reconcile conflicting Content-Length and Transfer-Encoding [boo#1268474, CVE-2026-54387]
  • Fixed failure to reject requests containing multiple Content-Length headers with differing values [boo#1268475, CVE-2026-54388]
  • Fixed failure to properly validate the Host header during stathost detection [boo#1268476, CVE-2026-55202]
Record
openSUSE-SU-2026:22133-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tinyproxy
Debian:12
 All versions, plus listed versions
1.11.1-2.11.11.1-2.1+deb12u11.11.1-31.11.1-41.11.2-11.11.2-1~bpo12+11.11.3-11.11.3-1~bpo13+1
 None known
tinyproxy
Debian:13
 All versions, plus listed versions
1.11.2-11.11.3-11.11.3-1~bpo13+1
 None known
tinyproxy
Debian:14
 All versions, plus listed versions
1.11.2-11.11.3-11.11.3-1~bpo13+1
 None known
tinyproxy
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.8.3-3ubuntu11.8.3-3ubuntu14.04.1~esm11.8.3-3ubuntu14.04.1~esm21.8.3-3ubuntu14.04.1~esm3
 None known
tinyproxy
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.8.3-3ubuntu11.8.3-3ubuntu16.04.1~esm11.8.3-3ubuntu16.04.1~esm21.8.3-3ubuntu16.04.1~esm3
 None known
tinyproxy
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.8.4-21.8.4-31.8.4-51.8.4-5ubuntu0.1~esm11.8.4-5ubuntu0.1~esm21.8.4-5ubuntu0.1~esm3
 None known
tinyproxy
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.10.0-21.10.0-41.10.0-4ubuntu0.11.10.0-4ubuntu0.2
 None known
tinyproxy
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.10.0-51.11.0-11.11.0-1ubuntu0.1~esm11.11.0-1ubuntu0.1~esm2
 None known
tinyproxy
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.11.1-2.11.11.1-31.11.1-3ubuntu0.1
 None known
tinyproxy
Ubuntu:25.10
 All versions, plus listed versions
1.11.2-1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
tinyproxy
Ubuntu:26.10
 All versions, plus listed versions
1.11.3-1
 None known
tinyproxy
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.11.2-11.11.2-1build11.11.3-1
 None known
tinyproxy
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.11.3-3.1
1.11.3-3.1
tinyproxy
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 1.11.3-bp160.2.1
1.11.3-bp160.2.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54387 is a critical vulnerability (CVSS 9.3) in Tinyproxy, published June 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. No source names a fixed version.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open