Skip to content
OpenAdvisories

Package · Debian

tinyproxy

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-54388

    Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers

    Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes …

    tinyproxy tinyproxy tinyproxy tinyproxy Debian Ubuntu
  • Critical 9.1
    CVE-2026-54387

    Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

    Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Re…

    tinyproxy tinyproxy tinyproxy tinyproxy Debian Ubuntu
  • Critical 9.8
    CVE-2023-49606 Public exploit EPSS 63%

    A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. …

    tinyproxy tinyproxy tinyproxy tinyproxy Debian Ubuntu Alpine