CVE-2026-54387 Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization
Attackers can desynchronize proxy and backend parsers via conflicting headers to inject requests, enabling cache poisoning and access control bypass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54387?
CVE-2026-54387 is a critical vulnerability in tinyproxy, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
Weakness: CWE-444
Which versions are affected by CVE-2026-54387?
How do I fix CVE-2026-54387?
Apply the vendor's patch.
Is CVE-2026-54387 being exploited?
There is no known exploitation of CVE-2026-54387 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-54387, GHSA-9667-7p67-2364, UBUNTU-CVE-2026-54387.