The vulnerability in rust-tiny-http (up to 0.12.0) arises from improper parsing of the Transfer-Encoding header. The library unconditionally applies chunk-decoding and ignores the Content-Length header when any Transfer-Encoding header is present, even if the value is non-chunked. This discrepancy between tiny-http's parsing and that of a correctly implemented front-end proxy allows attackers to craft requests that are interpreted differently by the proxy and the backend, enabling HTTP request smuggling attacks. Additionally, sending non-chunked bodies with non-chunked Transfer-Encoding values can cause failed body reads that tie up server connections and consume worker threads without client error notification.

This vulnerability allows remote attackers to perform HTTP request smuggling against applications using rust-tiny-http through 0.12.0. The attack can lead to desynchronization of request framing between the proxy and the backend server, potentially allowing attackers to bypass security controls, poison web caches, or perform other malicious actions. Additionally, the vulnerability can cause denial-of-service conditions by tying up connections and worker threads due to failed body reads without proper error signaling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider deploying additional protections at the proxy or firewall level to detect and block suspicious Transfer-Encoding headers. Monitoring for anomalous HTTP request patterns related to Transfer-Encoding may help mitigate exploitation attempts.