Executive brief
Tinyproxy, a lightweight web proxy, contains a vulnerability that allows attackers to interfere with how web requests are processed. By sending specially crafted requests with conflicting information, an attacker can trick the system into misinterpreting where one request ends and the next begins. This can lead to unauthorized access to sensitive data, the hijacking of other users' sessions, or the delivery of malicious content to users' browsers.
Technical details
Tinyproxy through 1.11.3 is vulnerable to HTTP Request Smuggling (CWE-444). The software fails to reject requests containing multiple Content-Length headers with differing values; it uses the first value for its own processing but forwards all duplicates to the backend. Additionally, it suffers from a CL/TE desync where it prioritizes Content-Length for body parsing but forwards both Content-Length and Transfer-Encoding headers to the backend. These inconsistencies allow a remote, unauthenticated attacker to desynchronize the proxy and backend parser states. Successful exploitation enables the injection of arbitrary HTTP requests into the backend connection, leading to cache poisoning, access control bypass, and request hijacking. The issue is fixed in commit 364cdb6.
Affected products
- tinyproxy Tinyproxy through 1.11.3
Timeline
- 2026-05-07: disclosed: Issue reported on GitHub by TristanInSec
- 2026-05-07: patched: Fix merged in PR #610 and commit 364cdb6
- 2026-06-17: advisory: CVE published and VulnCheck advisory released