CVE-2026-66752 in tiny-http
Summary
by MITRE • 07/28/2026
tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard Content-Length. Attackers can exploit the discrepancy between tiny_http's improper Transfer-Encoding parsing and a correctly-implemented front-end proxy to produce two distinct interpretations of a single byte stream, enabling request smuggling, and can additionally send non-chunked bodies with non-chunked Transfer-Encoding values to cause failed body reads that tie up connections and consume worker threads without signaling errors to clients.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The tiny-http library version 0.12.0 contains a critical HTTP request smuggling vulnerability that fundamentally undermines the integrity of request processing through improper handling of Transfer-Encoding headers. This vulnerability stems from the library's unconditional application of chunk-decoding regardless of the Transfer-Encoding value provided, creating a dangerous discrepancy between how tiny-http interprets incoming requests and how compliant HTTP implementations would process the same data. The flaw exists in the core request parsing logic where the library fails to properly validate or enforce the semantics of Transfer-Encoding headers, allowing attackers to craft malicious requests that exploit this inconsistency.
This vulnerability operates through a sophisticated desynchronization attack pattern that leverages the difference between tiny-http's flawed parsing behavior and correctly implemented front-end proxies. When an attacker sends a Transfer-Encoding header with any value including non-chunked codings, the library unconditionally strips away the Content-Length header and applies chunk-decoding to the request body. This creates a scenario where the same byte stream can be interpreted differently by the proxy and the tiny-http server, enabling attackers to smuggle requests through the system. The vulnerability maps directly to CWE-444 HTTP Request Smuggling and aligns with ATT&CK technique T1190 for Proxy Execution through the manipulation of HTTP headers.
The operational impact of this vulnerability extends beyond simple request smuggling to include resource exhaustion and connection management issues that can severely degrade system performance. Attackers can send non-chunked bodies with non-chunked Transfer-Encoding values, causing the library to attempt reading bodies that do not conform to chunked encoding standards. This results in failed body reads that tie up worker threads without properly signaling errors back to clients, creating a denial-of-service condition where legitimate connections become tied up and unavailable for processing. The behavior consumes system resources inefficiently while providing no meaningful feedback to the client, effectively creating a stealthy resource exhaustion attack vector.
Mitigation strategies must address both immediate operational concerns and fundamental architectural flaws in the library's HTTP parsing implementation. Organizations should implement immediate workarounds including proxy configuration changes that normalize Transfer-Encoding headers before they reach tiny-http instances, or deploy additional validation layers that ensure only properly formatted chunked encoding is accepted. The most effective long-term solution requires upgrading to patched versions of tiny-http that properly validate Transfer-Encoding header values and enforce correct HTTP semantics, as well as implementing comprehensive monitoring for unusual patterns in request processing that could indicate exploitation attempts. Additionally, system administrators should configure proper resource limits and connection timeouts to prevent the thread exhaustion effects from becoming a broader service disruption.