CVE-2026-54387Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

9.3CriticalCVSS base score
0.44%Exploitation in 30 daysEPSS · top 61% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.

Timeline

2026
12 Jun 2026
12 Jun 2026
ID reserved
By VulnCheck
17 Jun 20265 days later
17 Jun 2026· 5 days later
Published
8 Nov 20265 months later
8 Nov 2026· 5 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-54387, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Critical9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVDNVD · Deferred	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.44% · top 61% of all CVEs (13 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Affected products

tinyproxy · tinyproxy
- affected ≤ 1.11.3
- unaffected ff45d3bf0e61d0f8ed97ab379d3047f04eb67521

References4

Researcher Pull Request (opens in a new tab)issue-tracking
Maintainer Pull Request (opens in a new tab)issue-trackingpatch
Patch Commit (opens in a new tab)patch
https://www.vulncheck.com/advisories/tinyproxy-http-request-smuggling-via-cl-te-desynchronization (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-54387](https://cveledger.app/badge/CVE-2026-54387.svg)](https://cveledger.app/cve/CVE-2026-54387)

Record last updated 8 Nov 2026, 14:05 UTC.