Tinyproxy through 1.11.3

CVE-2026-54388 is an HTTP Request Smuggling flaw in Tinyproxy through version 1.11.3. The proxy fails to reject HTTP requests carrying multiple Content-Length headers with differing values. Instead, it reads the *first* value to decide how many body bytes to consume, then dutifully forwards *all* duplicate headers to the backend. If the backend server picks the *second* value, the two parsers desynchronize: the leftover bytes the proxy thought were part of the body become a brand-new, attacker-controlled request in the backend's eyes. This enables cache poisoning, access-control bypass, session hijacking, and exposure of internal endpoints—all without authentication.

The vendor-assigned CVSS 9.1 CRITICAL assumes the worst-case: unauthenticated, no user interaction, high confidentiality and integrity impact. That vector is *technically correct* but ignores two enormous real-world filters. First, the attack only works if the backend server also mishandles the duplicate Content-Length headers rather than rejecting them per RFC 7230 §3.3.2 (many modern stacks—Go net/http, recent Apache, nginx—do reject them). Second, Tinyproxy is a 2 MB lightweight proxy designed for embedded devices, Raspberry Pis, small-office WiFi, and container sidecars—not the proxy of choice for enterprises managing 10,000 hosts. The vendor severity overweights the theoretical attack surface and underweights the narrow blast radius and conditional backend requirement.

Why this verdict

• Backend compliance gate: RFC 7230 §3.3.2 requires servers to reject messages with multiple differing Content-Length values. Modern Go, nginx, and Apache stacks comply. This single prerequisite blocks the chain in a large fraction of deployments, removing the AC:L assumption from the vendor score.
• Small enterprise footprint: Tinyproxy is a 2 MB embedded-class proxy. Enterprises managing 10,000+ hosts overwhelmingly use Squid, HAProxy, nginx, or commercial proxies. The affected population in a typical large fleet is near zero.
• No exploitation activity: Zero KEV listing, no confirmed in-the-wild campaigns, EPSS at 0.44%, and no weaponized public PoC. The threat is theoretical today.
• Unauthenticated network vector is real: The AV:N/PR:N/UI:N vector is accurate—no credentials or user clicks needed. This prevents a deeper downgrade below HIGH.
• Role multiplier: Tinyproxy is NOT a canonical high-value-role component. It is not an identity provider, domain controller, hypervisor, PAM vault, backup server, CI/CD system, or network edge appliance. Its canonical deployment roles are (a) embedded device forward proxy, (b) container sidecar proxy, (c) small-office internet gateway. In the rare case it fronts a sensitive multi-tenant API backend with a non-RFC-compliant server, the blast radius could reach tenant-level data exposure, but this is an edge case representing well under 1% of installs. No high-value-role floor is triggered.

Why not higher?

The vendor's CRITICAL/9.1 assumes every backend will cooperatively misparse the smuggled headers. In practice, RFC 7230-compliant backends reject the malformed request outright, collapsing the chain before impact. There is no active exploitation, no PoC, and the EPSS is below 0.5%. The affected component is not a canonical high-value target.

Why not lower?

The vulnerability is unauthenticated and network-reachable with no user interaction—the most dangerous access vector class. HTTP smuggling, when it works, delivers high-impact outcomes (cache poisoning, access-control bypass, session hijacking) that can affect multiple users. Roughly 90,000 instances are internet-exposed. These factors together prevent a drop below HIGH.

1. Block duplicate Content-Length headers at the WAF or load balancer — Configure your WAF (ModSecurity, AWS WAF, Cloudflare) or upstream load balancer to reject any HTTP request containing more than one Content-Length header. This neutralizes the attack vector entirely. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Restrict Tinyproxy to trusted source IPs via Allow directives — In tinyproxy.conf, ensure Allow directives limit connections to known internal subnets. This reduces the attack surface from internet-wide to internal-only. Deploy within 30 days.
3. Place an RFC 7230-compliant reverse proxy in front of the backend — If you cannot patch Tinyproxy immediately, ensure the backend or an intermediary proxy (nginx, Envoy) rejects requests with duplicate Content-Length headers. This breaks the smuggling chain at step 3.
4. Upgrade Tinyproxy to a build containing commit 364cdb6 — Build from the main branch post-commit 364cdb67e0ea or wait for the next tagged release / distro package update. This is the definitive remediation. Apply within 180 days per noisgate remediation SLA for HIGH.

Run this on any host where Tinyproxy is installed. Execute as any user with read access to the tinyproxy binary. Example: bash check_cve_2026_54388.sh /usr/sbin/tinyproxy or simply bash check_cve_2026_54388.sh to auto-detect.

#!/usr/bin/env bash
# check_cve_2026_54388.sh - Check if Tinyproxy is vulnerable to CVE-2026-54388
# Usage: bash check_cve_2026_54388.sh [/path/to/tinyproxy]
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

BINARY="${1:-$(command -v tinyproxy 2>/dev/null || echo "")}"

if [ -z "$BINARY" ]; then
  echo "UNKNOWN - tinyproxy binary not found. Provide path as argument."
  exit 2
fi

if [ ! -x "$BINARY" ]; then
  echo "UNKNOWN - $BINARY is not executable."
  exit 2
fi

VERSION=$($BINARY -v 2>&1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - could not determine Tinyproxy version."
  exit 2
fi

echo "Detected Tinyproxy version: $VERSION"

# All versions through 1.11.3 are vulnerable
# Compare version: vulnerable if <= 1.11.3
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

if [ "$MAJOR" -lt 1 ]; then
  echo "VULNERABLE - Tinyproxy $VERSION is affected by CVE-2026-54388."
  exit 0
elif [ "$MAJOR" -eq 1 ] && [ "$MINOR" -lt 11 ]; then
  echo "VULNERABLE - Tinyproxy $VERSION is affected by CVE-2026-54388."
  exit 0
elif [ "$MAJOR" -eq 1 ] && [ "$MINOR" -eq 11 ] && [ "$PATCH" -le 3 ]; then
  echo "VULNERABLE - Tinyproxy $VERSION is affected by CVE-2026-54388."
  exit 0
else
  echo "PATCHED - Tinyproxy $VERSION is beyond the affected range (<=1.11.3)."
  exit 1
fi

Sources

1. Security Online – Tinyproxy Request Smuggling Flaws
2. GHSA-P3H9-73G9-X6M3 – Vulnerability Lookup (CIRCL)
3. Censys Advisory – Tinyproxy Exposure Data
4. BleepingComputer – 50,000 Tinyproxy Servers Vulnerable
5. THREATINT – CVE-2026-54388
6. Black Kite TPRM Insights – TinyProxy
7. Tinyproxy Official Site
8. SANS @Risk Newsletter Vol. XXVI-25