Skip to content
OpenAdvisories
High WID-SEC-2026-1999 3 CVEs

Tinyproxy: Mehrere Schwachstellen

Published Jun 17, 2026 · Updated Oct 20, 2026 · Revision 4 · de-DE

Vendor: Fedora Vendor: SUSE Product: Linux Product: openSUSE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Tinyproxy ausnutzen, um Dateien zu manipulieren und Sicherheitsmaßnahmen zu umgehen.

Product

Tinyproxy ist ein HTTP/HTTPS-Proxy-Daemon für POSIX-Betriebssysteme.

Vulnerabilities 3

  • Critical 9.1
    CVE-2026-54387

    Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

    Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Re…

    Tinyproxy Project tinyproxy tinyproxy tinyproxy Debian Ubuntu
  • Critical 9.1
    CVE-2026-54388

    Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers

    Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes …

    Tinyproxy Project tinyproxy tinyproxy tinyproxy Debian Ubuntu
  • High 8.2
    CVE-2026-55202

    Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

    Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation.…

    Tinyproxy Project tinyproxy tinyproxy tinyproxy Debian Ubuntu

Revision history

  1. #4

    Neue Updates von openSUSE aufgenommen

  2. #3

    Neue Updates von openSUSE aufgenommen

  3. #2

    Neue Updates von Fedora aufgenommen

  4. #1

    Initiale Fassung

References