CVE-2026-54387: Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

Synopsis

HTTP request smuggling via CL/TE desynchronization in Tinyproxy affects versions through 1.11.3. The flaw is reachable over the network with no authentication required, as Tinyproxy forwards conflicting Content-Length and Transfer-Encoding: chunked headers verbatim to the backend while using only Content-Length to measure how many body bytes to consume. Successful exploitation lets a remote attacker inject arbitrary HTTP requests into the backend connection, enabling cache poisoning, access control bypass, and request hijacking. A patched-image rebuild pinned to commit ff45d3bf0e61d0f8ed97ab379d3047f04eb67521 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Tinyproxy service over the network; no local or physical access is needed, and any internet-exposed or internally reachable proxy instance is in scope.

• AuthenticationNot required

  No credentials or session token are required; the attacker sends a crafted HTTP request as an anonymous client.

• Victim interactionNot required

  Exploitation is entirely server-side; no user needs to click a link, open a file, or take any action for the attack to succeed.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, memory layout dependency, or special environment state is needed to trigger the header desynchronization.

Blast Radius

• Reads any HTTP request body or header content transiting the proxy, including session tokens, credentials, and customer data forwarded to the backend.
• Injects arbitrary requests into the backend connection, overwriting or poisoning cached responses and causing other users to receive attacker-controlled content.
• Bypasses access controls enforced at the proxy layer by smuggling requests that the proxy never evaluates but the backend executes.
• Hijacks in-flight requests from other clients sharing the same backend connection, allowing the attacker to capture or manipulate their responses.