CVE-2026-31842 describes a vulnerability in Tinyproxy through version 1.11.3 where the Transfer-Encoding header is compared in a case-sensitive manner using strcmp in the is_chunked_transfer function within src/reqs.c. Since RFC 7230 specifies that transfer-coding names are case-insensitive, this implementation flaw can cause HTTP request parsing desynchronization, a form of HTTP request/response smuggling (CWE-444). This vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, and does not require privileges or user interaction to exploit. No official patch or remediation level has been published yet.

The vulnerability allows an attacker to exploit inconsistent interpretation of HTTP requests by Tinyproxy, potentially enabling HTTP request/response smuggling attacks. This can lead to bypassing security controls, request hijacking, or other malicious manipulation of HTTP traffic. The CVSS score of 8.7 reflects a high impact with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No temporary or official fixes have been documented at this time.