Tinyproxy Request Smuggling Flaws Expose Networks

TL;DR

Three critical Tinyproxy request smuggling vulnerabilities threaten network security. These flaws allow attackers to inject arbitrary HTTP requests. Administrators must patch their systems immediately to prevent severe network compromises.

Why It Matters

Tinyproxy acts as a vital tool for small network settings. It buffers high-speed server responses for slower clients. This buffering reduces internet sluggishness significantly. However, these new flaws break that protective layer. Attackers can poison web caches and bypass strict access controls. A successful Tinyproxy request smuggling attack leads to total request hijacking. This grants unauthorized users access to internal proxy statistics. Such breaches expose internal network architectures to outside threats.

How the Attack Works

The proxy fails to parse conflicting HTTP headers correctly. CVE-2026-54388 occurs when a request contains multiple Content-Length headers. You can read the VulnCheck advisory on duplicate headers for technical details. The proxy uses the first value but forwards all headers to the backend. Similarly, CVE-2026-54387 involves conflicting Content-Length and Transfer-Encoding headers. This desynchronizes the proxy and backend parser state. The advisory on CL-TE desynchronization outlines this parser confusion. Separately, CVE-2026-55202 involves improper validation of the Host header. Attackers inject a matching Host header to bypass detection mechanisms. In a similar threat context, researchers recently highlighted an Evil-WinRM path traversal flaw, emphasizing poor input validation risks. Currently, researchers have not confirmed any active exploitation in the wild.

Affected Versions

These three vulnerabilities affect all Tinyproxy releases through version 1.11.3.

Patch or Mitigation Steps

The development team fixed these issues in recent source code commits. System administrators should update their software installations immediately. Ensure your deployment includes commits 364cdb6, 09312a1, and ff45d3b. Monitor network traffic for unusual HTTP header patterns. Restrict proxy access to trusted internal IP addresses only.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.