CVE-2026-54388

CRITICAL EPSS 35.1%
Published Jun 17, 20262w ago · Modified Jun 22, 20261w ago
9.3 CVSS 4.0
Critical
Find Similar
Published Jun 17, 2026 2w ago
Last Modified Jun 22, 2026 1w ago

Description

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
35.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-444

References 4

  • github.com https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb
  • github.com https://github.com/tinyproxy/tinyproxy/issues/609
  • github.com https://github.com/tinyproxy/tinyproxy/pull/610
  • vulncheck.com https://www.vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-duplicate-content-length-headers

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.