HTTP Request Smuggling Vulnerability in tiny-http by Theopaid
CVE-2026-66752
Key Information:
Badges
What is CVE-2026-66752?
The tiny-http library, up to version 0.12.0, is susceptible to an HTTP request smuggling vulnerability due to improper handling of the Transfer-Encoding header. Attackers can exploit this flaw by sending crafted Transfer-Encoding headers, leading tiny-http to incorrectly parse requests and generate mismatched interpretations of a single byte stream between the server and an external proxy. This exploitation can allow attackers to initiate request smuggling attacks, potentially leading to unauthorized system access or resource exhaustion. By sending non-chunked bodies with inaccurate Transfer-Encoding values, attackers can also cause failed body reads, which may tie up server connections and consume worker threads without alerting clients.
Affected Version(s)
tiny-http 0 <= 0.12.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved