Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values,… (CVE-2026-54388)

Tinyproxy versions up to and including 1.11.3 fail to reject HTTP requests that contain multiple Content-Length headers with differing values. The proxy forwards all duplicate headers to the backend but uses only the first Content-Length value to determine how many bytes of the request body to consume. This discrepancy can cause the proxy and backend to become desynchronized in their parsing of the request, allowing remote attackers to inject arbitrary HTTP requests to the backend. The injection can facilitate cache poisoning, bypass of access controls, and hijacking of requests. The vulnerability is addressed in commit 364cdb6.

Exploitation of this vulnerability allows remote attackers to desynchronize the proxy and backend parser states, enabling injection of arbitrary HTTP requests to the backend server. This can result in cache poisoning, bypassing access controls, and hijacking legitimate requests, potentially compromising the integrity and security of backend services. The CVSS v3.1 score is 9.1, indicating a critical severity with high impact on confidentiality and integrity but no impact on availability.

A fix for this vulnerability is available and was introduced in commit 364cdb6. Users should upgrade Tinyproxy to a version that includes this commit or later to remediate the issue. Since the vulnerability is fixed in the source code, applying the official patch or upgrading to a patched version is the recommended mitigation.