Tinyproxy accepts requests that contain multiple Content-Length headers with conflicting values. The proxy forwards all duplicate headers to the backend while using only the first header to determine the size of the request body it consumes. This discrepancy desynchronizes the parser state between the proxy and the backend, allowing an attacker to inject arbitrary HTTP requests into the stream. The injected requests can poison caches, bypass access controls, or hijack legitimate traffic.

All Tinyproxy releases through version 1.11.3 are affected. Versions newer than 1.11.3 that include commit 364cdb67e0ea00a8e4a7037e2693e0711e816adb are not vulnerable.

The vulnerability has a CVSS score of 9.3, indicating critical severity. An EPSS score of less than 1% suggests a low probability of exploitation so far, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: an attacker sends a crafted HTTP request with duplicate Content-Length headers to the proxy, exploiting the desynchronization to inject malicious requests to the backend server, potentially leading to cache poisoning, authentication bypass, or request hijacking.