HTTP Request Smuggling Vulnerability in Tinyproxy by Tinyproxy

CVE-2026-54387

What is CVE-2026-54387?

Tinyproxy versions up to 1.11.3 exhibit a serious vulnerability due to improper handling of conflicting Content-Length and Transfer-Encoding headers. This flaw allows remote attackers to desynchronize the proxy and backend server state by forwarding both headers unchanged, which can lead to cache poisoning, bypass of access controls, and potential hijacking of requests. By exploiting this vulnerability, attackers can manipulate how requests are processed, potentially compromising the integrity and confidentiality of backend applications.

References