Description
Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.
Published: 2026-04-07
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Tinyproxy through version 1.11.3 incorrectly parses the Transfer-Encoding header because its is_chunked_transfer function uses strcmp to compare the header value against the literal 'chunked', while RFC 7230 states that transfer-coding names are case-insensitive. This case-sensitivity can cause HTTP request parsing desynchronization. An attacker can send a header such as 'Transfer-Encoding: Chunked' and trigger the flaw, potentially leading to malformed request handling or denial of service.

Affected Systems

The vulnerable product is Tinyproxy, produced by the Tinyproxy Project. The issue exists in all releases up through 1.11.3 and is mitigated in versions after 1.11.3.

Risk and Exploitability

The vulnerability has a high CVSS score of 8.7 and an EPSS score below 1 %, indicating a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. An unauthenticated attacker can trigger the flaw by issuing an HTTP request containing a case‑sensitive Transfer‑Encoding header, leading to denial of service of connected backend servers.

Generated by OpenCVE AI on August 10, 2026 at 23:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Tinyproxy to a version newer than 1.11.3, ensuring the case‑sensitive comparison has been fixed.
  • Add a network filtering rule or use a front‑end reverse proxy (e.g., HAProxy or Nginx) to normalize Transfer‑Encoding headers, converting them to lowercase before they reach Tinyproxy.
  • After update, test with malformed Transfer‑Encoding headers to confirm request parsing behaves correctly and no denial of service occurs.

Generated by OpenCVE AI on August 10, 2026 at 23:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp() to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive. By sending a request with Transfer-Encoding: Chunked, an unauthenticated remote attacker can cause Tinyproxy to misinterpret the request as having no body. In this state, Tinyproxy sets content_length.client to -1, skips pull_client_data_chunked(), forwards request headers upstream, and transitions into relay_connection() raw TCP forwarding while unread body data remains buffered. This leads to inconsistent request state between Tinyproxy and backend servers. RFC-compliant backends (e.g., Node.js, Nginx) will continue waiting for chunked body data, causing connections to hang indefinitely. This behavior enables application-level denial of service through backend worker exhaustion. Additionally, in deployments where Tinyproxy is used for request-body inspection, filtering, or security enforcement, the unread body may be forwarded without proper inspection, resulting in potential security control bypass. Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.
Title Tinyproxy - HTTP Request Parsing Desynchronization via Case-Sensitive Transfer-Encoding Handling Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling Tinyproxy - HTTP Request Parsing Desynchronization via Case-Sensitive Transfer-Encoding Handling

Wed, 29 Apr 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:tinyproxy_project:tinyproxy:*:*:*:*:*:*:*:*

Wed, 08 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Tinyproxy Project
Tinyproxy Project tinyproxy
Vendors & Products Tinyproxy Project
Tinyproxy Project tinyproxy

Tue, 07 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Description Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp() to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive. By sending a request with Transfer-Encoding: Chunked, an unauthenticated remote attacker can cause Tinyproxy to misinterpret the request as having no body. In this state, Tinyproxy sets content_length.client to -1, skips pull_client_data_chunked(), forwards request headers upstream, and transitions into relay_connection() raw TCP forwarding while unread body data remains buffered. This leads to inconsistent request state between Tinyproxy and backend servers. RFC-compliant backends (e.g., Node.js, Nginx) will continue waiting for chunked body data, causing connections to hang indefinitely. This behavior enables application-level denial of service through backend worker exhaustion. Additionally, in deployments where Tinyproxy is used for request-body inspection, filtering, or security enforcement, the unread body may be forwarded without proper inspection, resulting in potential security control bypass.
Title Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling
Weaknesses CWE-444
References
Metrics cvssV2_0

{'score': 7.8, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:C'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tinyproxy Project Tinyproxy
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:43:29.288Z

Reserved: 2026-03-09T18:20:23.398Z

Link: CVE-2026-31842

cve-icon Vulnrichment

Updated: 2026-04-07T16:30:35.022Z

cve-icon NVD

Status : Modified

Published: 2026-04-07T12:16:21.040

Modified: 2026-08-10T12:17:14.550

Link: CVE-2026-31842

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T00:00:08Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')