# CVE-2026-66752: tiny-http HTTP request smuggling via Transfer-Encoding handling

Source: https://junglewise.ai/threats/cve-2026-66752-tiny-http-http-request-smuggling-via-transfer-encoding-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-66752 · Severity: high · CVSS 7.2 · Published 2026-07-28

tiny-http is a lightweight library used to build web servers. A security flaw in how it handles web requests allows an attacker to interfere with the communication between a front-end proxy and the back-end server. This can lead to unauthorized access to data, the bypassing of security controls, or a denial-of-service condition where the server becomes unresponsive to legitimate users.

Technologies: [Tiny-Http](https://junglewise.ai/threats/technologies/tiny-http). Vendors: [Tiny-Http](https://junglewise.ai/threats/vendors/tiny-http).

## Quick answers

**Is CVE-2026-66752 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66752 being exploited in the wild.

**How severe is CVE-2026-66752?** High severity, with a CVSS score of 7.2, published 28 July 2026.

**Which products and versions are affected?** Tiny-Http <= 0.12.0.

**Is there a fix for CVE-2026-66752?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66752 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66752?** Check whether you run Tiny-Http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An HTTP request smuggling vulnerability (CWE-444) exists in tiny-http through version 0.12.0. The library incorrectly handles the Transfer-Encoding header by unconditionally applying chunk-decoding and discarding the Content-Length header whenever Transfer-Encoding is present, regardless of its value. An attacker can exploit this behavior to desynchronize the request stream between a front-end proxy and the tiny-http server. This can be used to smuggle malicious requests or cause a denial-of-service by tying up worker threads with failed body reads. The vulnerability is exploitable over the network without authentication.

## Affected products

- tiny-http tiny-http <= 0.12.0

## Timeline

- 2026-07-28: advisory: NVD publication date
- 2026-07-28: disclosed: Researcher disclosure by Theodosis Paidakis

## References

- [https://github.com/theopaid/HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-/tree/master](https://github.com/theopaid/HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-/tree/master)
- [https://www.vulncheck.com/advisories/tiny-http-http-request-smuggling-via-transfer-encoding-handling](https://www.vulncheck.com/advisories/tiny-http-http-request-smuggling-via-transfer-encoding-handling)

## Related threats

- [tiny-http HTTP header injection in header parsing and serialization](https://junglewise.ai/threats/cve-2026-66753-tiny-http-http-header-injection-in-header-parsing-and)
- [tiny-http directory traversal](https://junglewise.ai/threats/cve-2017-16097-tiny-http-directory-traversal)