CVE-2026-31842: HTTP Request Parsing in Tinyproxy

The vulnerability lies in Tinyproxy's handling of the Transfer-Encoding header. Due to a case-sensitive comparison against "chunked", the proxy can be tricked into believing a request has no body when a crafted request with Transfer-Encoding: Chunked is sent. This misinterpretation can lead to denial of service or potentially allow an attacker to bypass certain security checks by manipulating how Tinyproxy processes incoming requests. While the description doesn't explicitly detail data exfiltration, the ability to manipulate request processing could open avenues for further exploitation depending on the proxy's configuration and the backend servers it connects to.

1. Reserved2026-03-09
2. Published2026-04-07
3. EPSS updated2026-04-14

The primary mitigation is to upgrade Tinyproxy to version 1.11.4 or later, which contains the fix for this parsing issue. If upgrading immediately is not feasible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement without deep packet inspection, you could potentially restrict the Transfer-Encoding header to known, safe values. Monitoring Tinyproxy logs for unusual request patterns, particularly those involving the Transfer-Encoding header, can also help detect potential exploitation attempts. After upgrading, confirm the fix by sending a test request with Transfer-Encoding: Chunked and verifying that Tinyproxy handles it correctly without errors.