Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding… (CVE-2026-54387)

Tinyproxy versions up to and including 1.11.3 improperly handle HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers by forwarding both headers verbatim to the backend while using Content-Length to determine the request body length. This discrepancy can cause the proxy and backend to become desynchronized in their parsing of the HTTP request stream. An attacker can exploit this desynchronization to inject arbitrary HTTP requests to the backend server, potentially resulting in cache poisoning, bypass of access controls, and hijacking of requests. The vulnerability is addressed in commit ff45d3b.

Exploitation of this vulnerability allows remote attackers to inject arbitrary HTTP requests to the backend server through the proxy. This can lead to cache poisoning, which may serve malicious content to users; bypass of access control mechanisms, potentially exposing restricted resources; and hijacking of legitimate requests, undermining the integrity and security of backend services. The CVSS v3.1 score is 9.1, indicating a critical impact on confidentiality and integrity without requiring privileges or user interaction.

A fix is available and has been implemented in commit ff45d3b. Users and administrators should upgrade Tinyproxy to a version that includes this fix. Until patched, avoid deploying vulnerable versions in environments where untrusted HTTP traffic is proxied. Monitor vendor advisories for official release versions containing the fix.