PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54388 tinyproxy CVE debrief

CVE-2026-54388 is a critical vulnerability in Tinyproxy, a small HTTP proxy server. The issue allows remote attackers to desynchronize the proxy and backend parser state by sending requests with multiple Content-Length headers containing different values. This enables attackers to inject arbitrary HTTP requests to the backend, potentially leading to cache poisoning, access control bypass, and request hijacking. The vulnerability was fixed in commit 364cdb6. Organizations using Tinyproxy should take immediate action to mitigate this vulnerability.

Vendor
tinyproxy
Product
tinyproxy
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-07-14
Advisory published
2026-06-17
Advisory updated
2026-07-14

Who should care

System administrators and security teams responsible for Tinyproxy installations should be aware of this critical vulnerability. Additionally, developers and DevOps teams using Tinyproxy in their infrastructure should prioritize patching to prevent potential attacks.

Technical summary

Tinyproxy through version 1.11.3 fails to reject requests containing multiple Content-Length headers with differing values. Instead, it forwards all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. This behavior allows remote attackers to desynchronize the proxy and backend parser state, enabling injection of arbitrary HTTP requests to the backend. The vulnerability has a CVSS score of 9.3 and is classified as CRITICAL.

Defensive priority

High

Recommended defensive actions

  • Update Tinyproxy to the latest version or apply the fix from commit 364cdb6.
  • Review and restrict incoming requests to prevent multiple Content-Length headers.
  • Implement additional monitoring to detect potential exploitation attempts.
  • Consider using alternative HTTP proxy solutions with built-in protection against such attacks.
  • Regularly review and update Tinyproxy configurations to ensure secure operation.
  • Isolate critical systems and services to limit the attack surface.

Evidence notes

The information provided is based on data from the National Vulnerability Database (NVD) and Vulncheck. The CVE record and NVD detail pages provide official information about the vulnerability. Additional sources include GitHub commits, issues, and pull requests related to the Tinyproxy project.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54388 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54388

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54388 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54388

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.