CVE-2026-54387: Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tinyproxyto a version that resolves this vulnerability.Fixed in 1.11.3Patch ff45d3b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54387?
The severity of CVE-2026-54387 is rated critical with a score of 9.1.
How do I fix CVE-2026-54387?
To fix CVE-2026-54387, upgrade Tinyproxy to version 1.11.4 or later, which includes the required patches.
What type of attack does CVE-2026-54387 enable?
CVE-2026-54387 enables HTTP request smuggling via CL/TE desynchronization.
What versions of Tinyproxy are affected by CVE-2026-54387?
Tinyproxy versions prior to 1.11.4 are affected by CVE-2026-54387.
Can CVE-2026-54387 lead to unauthorized data access?
Yes, CVE-2026-54387 could allow remote attackers to potentially access sensitive data due to request smuggling.