CVE-2026-54388
Critical · CVSS 9.1Tinyproxy — HTTP Request Smuggling via duplicate Content-Length headers (CWE-444)
- CVSS
- 9.1
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-444
Description
Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
Search profile — drives PoC discovery
Symbols Content-Lengthduplicate Content-Length364cdb6364cdb67e0ea00a8e4a7037e2693e0711e816adbtinyproxyrequest smugglingparse_requestcontent_length
Keywords CVE-2026-54388TinyproxyHTTP request smugglingduplicate Content-LengthCWE-444cache poisoningaccess control bypassrequest hijackingtinyproxy 1.11.3tinyproxy smuggling PoCtinyproxy 364cdb6
Versions: through 1.11.3 (fixed in commit 364cdb6)
References
- https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb
- https://github.com/tinyproxy/tinyproxy/issues/609
- https://github.com/tinyproxy/tinyproxy/pull/610
- https://www.vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-duplicate-content-length-headers
- https://github.com/tinyproxy/tinyproxy/issues/609
Status: enriched · ingested 2026-07-15T00:00:20.000Z · profiled 2026-07-15T00:30:20.000Z