CVE-2026-66752

Name of the Vulnerable Software and Affected Versions tiny-http versions prior to 0.12.1

Description An issue exists where the library improperly parses the Transfer-Encoding header. By sending this header with any value, including non-chunked codings, the library unconditionally applies chunk-decoding and ignores the Content-Length header. This creates a discrepancy between the library and a correctly implemented front-end proxy, allowing remote attackers to desynchronize request framing and perform request smuggling. Additionally, sending non-chunked bodies with non-chunked Transfer-Encoding values can lead to failed body reads, which consumes worker threads and ties up connections without notifying clients of the error.

Recommendations Update to a version newer than 0.12.0.