Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-54387 HTTP Request Smuggling in Tinyproxy Through 1.11.3 via Header Desynchronization https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54387
Post summary
The text announces the discovery of a new HTTP request smuggling vulnerability (CVE-2026-54387) affecting Tinyproxy up to version 1.11.3, describing its technical nature without providing a PoC, exploit, or mitigation.
CVE-2026-54387 Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to t… https://www.cve.org/CVERecord?id=CVE-2026-54387
Post summary
Tinyproxy up to version 1.11.3 is vulnerable due to conflicting Content‑Length and Transfer‑Encoding: chunked headers being forwarded verbatim; the issue was fixed in commit ff45d3b.