Executive brief
tiny-http is a lightweight library used to build web servers. A security flaw in how it handles web requests allows an attacker to interfere with the communication between a front-end proxy and the back-end server. This can lead to unauthorized access to data, the bypassing of security controls, or a denial-of-service condition where the server becomes unresponsive to legitimate users.
Technical details
An HTTP request smuggling vulnerability (CWE-444) exists in tiny-http through version 0.12.0. The library incorrectly handles the Transfer-Encoding header by unconditionally applying chunk-decoding and discarding the Content-Length header whenever Transfer-Encoding is present, regardless of its value. An attacker can exploit this behavior to desynchronize the request stream between a front-end proxy and the tiny-http server. This can be used to smuggle malicious requests or cause a denial-of-service by tying up worker threads with failed body reads. The vulnerability is exploitable over the network without authentication.
Affected products
- tiny-http tiny-http <= 0.12.0
Timeline
- 2026-07-28: advisory: NVD publication date
- 2026-07-28: disclosed: Researcher disclosure by Theodosis Paidakis