CVE-2026-54387

CRITICAL EPSS 35.1%
Published Jun 17, 20261w ago · Modified Jun 22, 20261w ago
9.3 CVSS 4.0
Critical
Find Similar
Published Jun 17, 2026 1w ago
Last Modified Jun 22, 2026 1w ago

Description

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
35.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-444

References 4

  • github.com https://github.com/tinyproxy/tinyproxy/commit/ff45d3bf0e61d0f8ed97ab379d3047f04eb67521
  • github.com https://github.com/tinyproxy/tinyproxy/issues/609
  • github.com https://github.com/tinyproxy/tinyproxy/pull/610
  • vulncheck.com https://www.vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-cl-te-desynchronization

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.