Tinyproxy up to 1.11.3 HTTP Request src/reqs.c is_chunked_transfer request smuggling

Summaryinfo

A vulnerability has been found in Tinyproxy up to 1.11.3 and classified as critical. Affected by this vulnerability is the function is_chunked_transfer of the file src/reqs.c of the component HTTP Request Handler. This manipulation causes request smuggling. The identification of this vulnerability is CVE-2026-31842. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Tinyproxy up to 1.11.3 and classified as critical. Affected by this vulnerability is the function is_chunked_transfer of the file src/reqs.c of the component HTTP Request Handler. The manipulation with an unknown input leads to a request smuggling vulnerability. The CWE definition for the vulnerability is CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp() to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive. By sending a request with Transfer-Encoding: Chunked, an unauthenticated remote attacker can cause Tinyproxy to misinterpret the request as having no body. In this state, Tinyproxy sets content_length.client to -1, skips pull_client_data_chunked(), forwards request headers upstream, and transitions into relay_connection() raw TCP forwarding while unread body data remains buffered. This leads to inconsistent request state between Tinyproxy and backend servers. RFC-compliant backends (e.g., Node.js, Nginx) will continue waiting for chunked body data, causing connections to hang indefinitely. This behavior enables application-level denial of service through backend worker exhaustion. Additionally, in deployments where Tinyproxy is used for request-body inspection, filtering, or security enforcement, the unread body may be forwarded without proper inspection, resulting in potential security control bypass.

The weakness was shared by Muxammadiyev G'iyosiddin. The advisory is shared at github.com. This vulnerability is known as CVE-2026-31842 since 03/09/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/09/2026).

The vulnerability scanner Nessus provides a plugin with the ID 305657 (Fedora 45 : tinyproxy (2026-1c7a717dbc)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (305657), EUVD (EUVD-2026-19603) and CERT Bund (WID-SEC-2026-0999). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source Tinyproxy

Productinfo

Type

• Firewall Software

Name

• Tinyproxy

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3

Website

• Product: https://github.com/tinyproxy/tinyproxy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion