CVE-2026-54387

Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to commit ff45d3b

Description Tinyproxy fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine the number of request body bytes to consume. This allows remote attackers to desynchronize the proxy and backend parser state, enabling the injection of arbitrary HTTP requests to the backend. This can lead to cache poisoning, access control bypass, and request hijacking. This issue is a form of HTTP Request Smuggling, where a discrepancy in how different servers interpret the end of a request allows a second request to be smuggled through.

Recommendations Update to the version containing commit ff45d3b.