# CVE-2026-54387: Tinyproxy HTTP request smuggling in request header parsing

Source: https://junglewise.ai/threats/cve-2026-54387-tinyproxy-http-request-smuggling-in-request-header-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-54387 · Severity: critical · CVSS 9.1 · Published 2026-06-17

Tinyproxy is a lightweight web proxy used to manage and route internet traffic. A security flaw allows attackers to send specially crafted web requests that confuse the communication between the proxy and the destination server. This can lead to "request smuggling," where an attacker can bypass security controls, hijack user sessions, or poison the web cache to serve malicious content to other users.

Technologies: [Tinyproxy](https://junglewise.ai/threats/technologies/tinyproxy). Vendors: [Tinyproxy](https://junglewise.ai/threats/vendors/tinyproxy).

## Quick answers

**Is CVE-2026-54387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54387 being exploited in the wild.

**How severe is CVE-2026-54387?** Critical severity, with a CVSS score of 9.1, published 17 June 2026.

**Which products and versions are affected?** Tinyproxy through 1.11.3.

**Is there a fix for CVE-2026-54387?** A patch was published on 2026-05-07: Fix merged in commit ff45d3b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54387 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-54387?** Check whether you run Tinyproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Tinyproxy fails to properly reconcile conflicting 'Content-Length' and 'Transfer-Encoding: chunked' headers in HTTP requests. Specifically, the proxy uses the Content-Length header to determine the request body size for its own processing but forwards both headers to the backend server. Per RFC 7230, the backend should prioritize Transfer-Encoding, leading to a desynchronization (CL.TE) where the backend interprets part of the original request body as a subsequent, separate request. This enables request smuggling, cache poisoning, and security bypass. The issue is fixed in commit ff45d3b by ensuring Content-Length is removed or ignored when chunked encoding is present.

## Affected products

- Tinyproxy Tinyproxy through 1.11.3

## Timeline

- 2026-05-07: disclosed: Vulnerability reported via GitHub issue #609
- 2026-05-07: patched: Fix merged in commit ff45d3b
- 2026-06-17: advisory: CVE-2026-54387 published

## References

- [https://github.com/tinyproxy/tinyproxy/commit/ff45d3bf0e61d0f8ed97ab379d3047f04eb67521](https://github.com/tinyproxy/tinyproxy/commit/ff45d3bf0e61d0f8ed97ab379d3047f04eb67521)
- [https://github.com/tinyproxy/tinyproxy/issues/609](https://github.com/tinyproxy/tinyproxy/issues/609)
- [https://github.com/tinyproxy/tinyproxy/pull/610](https://github.com/tinyproxy/tinyproxy/pull/610)
- [https://www.vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-cl-te-desynchronization](https://www.vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-cl-te-desynchronization)

## Related threats

- [Tinyproxy access control bypass in hostname matching](https://junglewise.ai/threats/cve-2026-125371-tinyproxy-through-1-11-3-contains-an-access-control-bypass)
- [Tinyproxy authentication bypass in stathost detection](https://junglewise.ai/threats/cve-2026-55202-tinyproxy-authentication-bypass-in-stathost-detection)
- [Tinyproxy HTTP request smuggling via duplicate Content-Length headers](https://junglewise.ai/threats/cve-2026-54388-tinyproxy-http-request-smuggling-via-duplicate-content-length)
- [tinyproxy integer overflow in HTTP chunked transfer encoding](https://junglewise.ai/threats/cve-2026-3945-tinyproxy-integer-overflow-in-http-chunked-transfer-encoding)