CVE-2026-31842

Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to 1.11.4

Description HTTP request parsing desynchronization occurs due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is chunked transfer() function uses strcmp() to compare the header value against "chunked", contradicting RFC 7230 which specifies that transfer-coding names are case-insensitive. An unauthenticated remote attacker can send a request with Transfer-Encoding: Chunked, causing the software to misinterpret the request as having no body. Consequently, the system sets content length.client to -1, skips pull client data chunked(), forwards headers upstream, and enters relay connection() raw TCP forwarding while body data remains buffered. This creates an inconsistent state where RFC-compliant backends continue waiting for chunked data, leading to application-level denial of service via backend worker exhaustion. Furthermore, if the software is used for request-body inspection or filtering, the unread body may be forwarded without inspection, allowing a security control bypass.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.