Executive brief
Tinyproxy is a lightweight web proxy used to manage and route internet traffic. A security flaw allows attackers to send specially crafted web requests that confuse the communication between the proxy and the destination server. This can lead to "request smuggling," where an attacker can bypass security controls, hijack user sessions, or poison the web cache to serve malicious content to other users.
Technical details
Tinyproxy fails to properly reconcile conflicting 'Content-Length' and 'Transfer-Encoding: chunked' headers in HTTP requests. Specifically, the proxy uses the Content-Length header to determine the request body size for its own processing but forwards both headers to the backend server. Per RFC 7230, the backend should prioritize Transfer-Encoding, leading to a desynchronization (CL.TE) where the backend interprets part of the original request body as a subsequent, separate request. This enables request smuggling, cache poisoning, and security bypass. The issue is fixed in commit ff45d3b by ensuring Content-Length is removed or ignored when chunked encoding is present.
Affected products
- Tinyproxy Tinyproxy through 1.11.3
Timeline
- 2026-05-07: disclosed: Vulnerability reported via GitHub issue #609
- 2026-05-07: patched: Fix merged in commit ff45d3b
- 2026-06-17: advisory: CVE-2026-54387 published