CVE-2026-54388: Tinyproxy HTTP request smuggling via duplicate Content-Length headers

CVE-2026-54388 · Severity: critical · CVSS 9.1 · Published 2026-06-17

Tinyproxy, a lightweight web proxy, contains a vulnerability that allows attackers to interfere with how web requests are processed. By sending specially crafted requests with conflicting information, an attacker can trick the system into misinterpreting where one request ends and the next begins. This can lead to unauthorized access to sensitive data, the hijacking of other users' sessions, or the delivery of malicious content to users' browsers.

Technologies: Tinyproxy. Vendors: Tinyproxy.

Quick answers

Is CVE-2026-54388 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54388 being exploited in the wild.
How severe is CVE-2026-54388?
Critical severity, with a CVSS score of 9.1, published 17 June 2026.
Which products and versions are affected?
Tinyproxy through 1.11.3.
Is there a fix for CVE-2026-54388?
A patch was published on 2026-05-07: Fix merged in PR #610 and commit 364cdb6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54388 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54388?
Check whether you run Tinyproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Tinyproxy through 1.11.3 is vulnerable to HTTP Request Smuggling (CWE-444). The software fails to reject requests containing multiple Content-Length headers with differing values; it uses the first value for its own processing but forwards all duplicates to the backend. Additionally, it suffers from a CL/TE desync where it prioritizes Content-Length for body parsing but forwards both Content-Length and Transfer-Encoding headers to the backend. These inconsistencies allow a remote, unauthenticated attacker to desynchronize the proxy and backend parser states. Successful exploitation enables the injection of arbitrary HTTP requests into the backend connection, leading to cache poisoning, access control bypass, and request hijacking. The issue is fixed in commit 364cdb6.

Affected products

  • tinyproxy Tinyproxy through 1.11.3

Timeline

  • 2026-05-07: disclosed: Issue reported on GitHub by TristanInSec
  • 2026-05-07: patched: Fix merged in PR #610 and commit 364cdb6
  • 2026-06-17: advisory: CVE published and VulnCheck advisory released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.