CVE-2026-31842: Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling

Q: What is the severity of CVE-2026-31842?

CVE-2026-31842 is classified as a high-severity vulnerability due to potential HTTP request parsing desynchronization.

Q: How do I fix CVE-2026-31842?

To fix CVE-2026-31842, upgrade Tinyproxy to version 1.11.4 or later, which addresses the case-sensitive Transfer-Encoding handling.

Q: What versions of Tinyproxy are affected by CVE-2026-31842?

CVE-2026-31842 affects Tinyproxy versions up to and including 1.11.3.

Q: What type of vulnerability is CVE-2026-31842?

CVE-2026-31842 is a vulnerability related to HTTP request parsing and inefficient handling of Transfer-Encoding.

Q: Is CVE-2026-31842 exploitable remotely?

Yes, CVE-2026-31842 is potentially exploitable remotely, allowing an attacker to manipulate HTTP requests.

Published Apr 7, 2026

Updated

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The ischunkedtransfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.

Affected Software

2 affected components

tinyproxy tinyproxy<=1.11.3

Tinyproxy Project Tinyproxy<=1.11.3

Event History

Apr 7, 2026

CVE Published

via MITRE·11:17 AM

Data Sourced

via MITRE·11:17 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-31842?

CVE-2026-31842 is classified as a high-severity vulnerability due to potential HTTP request parsing desynchronization.

How do I fix CVE-2026-31842?

To fix CVE-2026-31842, upgrade Tinyproxy to version 1.11.4 or later, which addresses the case-sensitive Transfer-Encoding handling.

What versions of Tinyproxy are affected by CVE-2026-31842?