CVE-2026-54388
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk30th percentile — higher than 30% of all known CVEs
Summary
Tinyproxy versions up to 1.11.3 fail to reject requests containing multiple Content-Length headers with differing values, leading to all duplicate headers being forwarded to the backend. Attackers can exploit this vulnerability to inject arbitrary HTTP requests to the backend.
Risk Assessment
This vulnerability can lead to cache poisoning, access control bypass, and request hijacking, posing a serious threat to the security of the application and the organization's data.
Recommendation
It is recommended to upgrade Tinyproxy to version 1.11.4 or later to mitigate this vulnerability and to monitor logs for potential attack attempts.
Original NVD description (English source)
Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.