Muxammadiyev Giyosiddin

**Name of the Vulnerable Software and Affected Versions** Tinyproxy versions prior to 1.11.4 **Description** HTTP request parsing desynchronization occurs due to a case-sensitive comparison of the `Transfer-Encoding` header in src/reqs.c. The `is chunked transfer()` function uses `strcmp()` to compare the header value against "chunked", contradicting RFC 7230 which specifies that transfer-coding names are case-insensitive. An unauthenticated remote attacker can send a request with `Transfer-Encoding: Chunked`, causing the software to misinterpret the request as having no body. Consequently, the system sets `content length.client` to -1, skips `pull client data chunked()`, forwards headers upstream, and enters `relay connection()` raw TCP forwarding while body data remains buffered. This creates an inconsistent state where RFC-compliant backends continue waiting for chunked data, leading to application-level denial of service via backend worker exhaustion. Furthermore, if the software is used for request-body inspection or filtering, the unread body may be forwarded without inspection, allowing a security control bypass. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tinyproxy versions prior to 1.11.3-2.1 **Description** An integer overflow exists in the HTTP chunked transfer encoding parser. The issue occurs because chunk size values are parsed using the `strtol()` function without properly validating overflow conditions, such as `errno == ERANGE`. A crafted chunk size, such as `0x7fffffffffffffff` (LONG MAX), can bypass the `chunklen < 0` validation check, leading to a signed integer overflow during the `chunklen + 2` arithmetic operation. This results in incorrect size calculations, causing the proxy to attempt to read an excessively large amount of request-body data and keeping worker connections open indefinitely. An unauthenticated remote attacker can exploit this to exhaust all available worker slots, preventing new connections and causing a complete denial of service (DoS). **Recommendations** Update to version 1.11.3-2.1.