CVE-2026-31842CWE-444

CVE-2026-31842

High · published April 7, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00743 · 54.2th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-04-07T16:16Z
Affected products (1)
ProductVersionsFixed in
tinyproxy_project/tinyproxy≤ 1.11.3—
References (3)
https://datatracker.ietf.org/doc/html/rfc7230 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/tinyproxy/tinyproxy · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/tinyproxy/tinyproxy/issues/604 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 07 APR 11:17Z
    Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling
    cvelistv5