Is CVE-2026-54387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54387 being exploited in the wild.

How severe is CVE-2026-54387?

Critical severity, with a CVSS score of 9.1, published 17 June 2026.

Is there a fix for CVE-2026-54387?

A patch was published on 2026-05-07: Fix merged in commit ff45d3b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54387 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-54387?

Check whether you run Tinyproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54387: Tinyproxy HTTP request smuggling in request header parsing

CVE-2026-54387 · Severity: critical · CVSS 9.1 · Published 2026-06-17

Tinyproxy is a lightweight web proxy used to manage and route internet traffic. A security flaw allows attackers to send specially crafted web requests that confuse the communication between the proxy and the destination server. This can lead to "request smuggling," where an attacker can bypass security controls, hijack user sessions, or poison the web cache to serve malicious content to other users.

Technologies: Tinyproxy. Vendors: Tinyproxy.

Quick answers

Is CVE-2026-54387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54387 being exploited in the wild.
How severe is CVE-2026-54387?: Critical severity, with a CVSS score of 9.1, published 17 June 2026.
Which products and versions are affected?: Tinyproxy through 1.11.3.
Is there a fix for CVE-2026-54387?: A patch was published on 2026-05-07: Fix merged in commit ff45d3b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54387 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54387?: Check whether you run Tinyproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Tinyproxy fails to properly reconcile conflicting 'Content-Length' and 'Transfer-Encoding: chunked' headers in HTTP requests. Specifically, the proxy uses the Content-Length header to determine the request body size for its own processing but forwards both headers to the backend server. Per RFC 7230, the backend should prioritize Transfer-Encoding, leading to a desynchronization (CL.TE) where the backend interprets part of the original request body as a subsequent, separate request. This enables request smuggling, cache poisoning, and security bypass. The issue is fixed in commit ff45d3b by ensuring Content-Length is removed or ignored when chunked encoding is present.

Affected products

Tinyproxy Tinyproxy through 1.11.3

Timeline

2026-05-07: disclosed: Vulnerability reported via GitHub issue #609
2026-05-07: patched: Fix merged in commit ff45d3b
2026-06-17: advisory: CVE-2026-54387 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.