PatchSiren

Tinyproxy Project CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Tinyproxy Project CVE published 2026-04-07

CVE-2026-31842

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against 'chunked', even though RFC 7230 specifies that transfer-coding names are case-insensitive. This vulnerability can lead to desynchronization attacks if exploited, em [truncated]