CVE-2026-31842 affects Tinyproxy through version 1.11.3 and arises from the is_chunked_transfer() function using a case-sensitive strcmp() to compare the Transfer-Encoding header value against "chunked". RFC 7230 mandates that transfer-coding names are case-insensitive, so a header value of "Chunked" is not recognized properly. This leads Tinyproxy to treat the request as having no body, setting content_length.client to -1, skipping chunked data processing, and forwarding headers upstream while buffered body data remains unread. Backend servers that follow RFC 7230 continue waiting for the chunked body, causing connections to hang and backend worker exhaustion, resulting in denial of service. In configurations where Tinyproxy performs request-body inspection or filtering, the unread body may be forwarded without inspection, potentially bypassing security controls.

An unauthenticated remote attacker can cause denial of service by exploiting the inconsistent HTTP request parsing, leading to backend server worker exhaustion due to hanging connections. Additionally, security controls relying on Tinyproxy's request-body inspection can be bypassed, allowing potentially malicious data to reach backend servers uninspected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the risk of denial of service and potential security bypass in Tinyproxy deployments. Consider implementing compensating controls such as limiting connection timeouts on backend servers or using alternative proxies that correctly handle Transfer-Encoding headers.