CVE-2026-54388: Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers

Synopsis

HTTP request smuggling in Tinyproxy allows a remote, unauthenticated attacker to desynchronize the proxy and backend HTTP parser state by sending requests with multiple conflicting Content-Length headers. The vulnerability is reachable over the network with no authentication required. Successful exploitation enables cache poisoning, access control bypass, and arbitrary HTTP request injection to the backend server. A patched-image rebuild at commit 364cdb67e0ea00a8e4a7037e2693e0711e816adb is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Tinyproxy service over the network; the vulnerability is exposed to any client that can send HTTP requests to the proxy (AV:N).

• AuthenticationNot required

  No credentials or session are needed; the malicious request can be sent by any unauthenticated HTTP client (PR:N).

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from a legitimate user or administrator (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental state are required to trigger the header smuggling (AC:L, AT:N).

Blast Radius

• An attacker reads responses intended for other users by hijacking in-flight backend requests, exposing session tokens or sensitive application data (VC:H).
• An attacker injects arbitrary HTTP requests to the backend, modifying persisted application state or poisoning shared caches to serve malicious content to subsequent users (VI:H).
• Access control rules enforced by Tinyproxy or the backend can be bypassed entirely, reaching endpoints or resources that should be restricted to privileged users.
• Cache poisoning allows the attacker to plant crafted responses that are served to any user whose request hits the poisoned cache entry, amplifying impact beyond the initial exploit.