CVE-2026-31842: Tinyproxy Project Tinyproxy

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.

Affected products

• Tinyproxy Project Tinyproxy: up to and including 1.11.3

Published 2026-04-07. Last modified 2026-08-10.