CVE-2026-31842 Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling
Attackers can desynchronize HTTP request parsing in Tinyproxy by exploiting case-sensitive Transfer-Encoding checks, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31842?
CVE-2026-31842 is a high-severity vulnerability in Tinyproxy, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.
Weakness: CWE-444
Which versions are affected by CVE-2026-31842?
It affects 1 product.
Products include Tinyproxy Project Tinyproxy.
How do I fix CVE-2026-31842?
No fix has been published for CVE-2026-31842 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-31842 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31842 exists.
Other vulnerabilities in Tinyproxy
Sources
Also known as DEBIAN-CVE-2026-31842, GHSA-mh87-c4c3-cgwf, UBUNTU-CVE-2026-31842.