PT-2026-65522 · Tinyhttpd · Tiny-Http

Theodosis Paidakis · CVE-2026-66752 · Published 2026-07-28 · Updated 2026-07-28

NVD

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard Content-Length. Attackers can exploit the discrepancy between tiny http's improper Transfer-Encoding parsing and a correctly-implemented front-end proxy to produce two distinct interpretations of a single byte stream, enabling request smuggling, and can additionally send non-chunked bodies with non-chunked Transfer-Encoding values to cause failed body reads that tie up connections and consume worker threads without signaling errors to clients.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-66752

Affected Products

Tiny-Http

References · 3

• 🔥 https://github.com/theopaid/HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-/tree/master · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-66752 · Security Note
• https://vulncheck.com/advisories/tiny-http-http-request-smuggling-via-transfer-encoding-handling · Note