PT-2026-50539 · Tinyproxy · Tinyproxy

Tristan Madani · Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-54388

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to 1.11.4

Description Tinyproxy fails to reject requests containing multiple Content-Length headers with differing values. The software forwards all duplicate headers to the backend but uses only the first value to determine the number of request body bytes to consume. This behavior allows remote attackers to desynchronize the proxy and backend parser state, leading to HTTP Request Smuggling. This technique enables the injection of arbitrary HTTP requests to the backend, which can result in cache poisoning, access control bypass, and request hijacking.

Recommendations Update to the version containing commit 364cdb6.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-54388

Affected Products

Tinyproxy

References · 6

• https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb · Patch
• https://github.com/tinyproxy/tinyproxy/pull/610 · Note
• https://github.com/tinyproxy/tinyproxy/issues/609 · Note
• https://twitter.com/CVEnew/status/2067350975430455667 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2067391778416627718 · Twitter Post
• https://vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-duplicate-content-length-headers · Note