Critical
tinyproxy — security advisory
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
- Products
- tinyproxy
- Affected versions
- 1.10.0-2, 1.10.0-4, 1.10.0-4ubuntu0.1, 1.10.0-4ubuntu0.2, 1.10.0-5, 1.11.0-1, 1.11.0-1ubuntu0.1~esm1, 1.11.0-1ubuntu0.1~esm2, 1.11.1-2.1, 1.11.1-3, 1.11.1-3ubuntu0.1, 1.11.2-1, 1.11.2-1build1, 1.11.3-1, 1.8.3-3ubuntu1, 1.8.3-3ubuntu14.04.1~esm1, 1.8.3-3ubuntu14.04.1~esm2, 1.8.3-3ubuntu14.04.1~esm3, 1.8.3-3ubuntu16.04.1~esm1, 1.8.3-3ubuntu16.04.1~esm2, 1.8.3-3ubuntu16.04.1~esm3, 1.8.4-2, 1.8.4-3, 1.8.4-5, 1.8.4-5ubuntu0.1~esm1, 1.8.4-5ubuntu0.1~esm2, 1.8.4-5ubuntu0.1~esm3
- Fixed versions
- Not specified
- CVEs
- CVE-2026-54387
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:29 UTC · Revision 1
Source evidence
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
osv:UBUNTU-CVE-2026-54387
tinyproxy
Fixed versions: Not specified
tinyproxy
Fixed versions: Not specified
tinyproxy
Fixed versions: Not specified
tinyproxy
Fixed versions: Not specified
tinyproxy
Fixed versions: Not specified
tinyproxy
Fixed versions: Not specified
tinyproxy
Fixed versions: Not specified
tinyproxy
Fixed versions: Not specified
tinyproxy
Fixed versions: Not specified
Complete source record
{
"id": "5609aefb0f9d5593f8727289222b917b87db6814c9f13b62cad0090ec3f70d2b",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-54387",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-54387",
"summary": "Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.",
"evidence": "osv:UBUNTU-CVE-2026-54387",
"products": [
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8.3-3ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.8.3-3ubuntu14.04.1~esm1",
"evidence": "/affected/0/versions"
},
{
"value": "1.8.3-3ubuntu14.04.1~esm2",
"evidence": "/affected/0/versions"
},
{
"value": "1.8.3-3ubuntu14.04.1~esm3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8.3-3ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "1.8.3-3ubuntu16.04.1~esm1",
"evidence": "/affected/1/versions"
},
{
"value": "1.8.3-3ubuntu16.04.1~esm2",
"evidence": "/affected/1/versions"
},
{
"value": "1.8.3-3ubuntu16.04.1~esm3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.8.4-2",
"evidence": "/affected/2/versions"
},
{
"value": "1.8.4-3",
"evidence": "/affected/2/versions"
},
{
"value": "1.8.4-5",
"evidence": "/affected/2/versions"
},
{
"value": "1.8.4-5ubuntu0.1~esm1",
"evidence": "/affected/2/versions"
},
{
"value": "1.8.4-5ubuntu0.1~esm2",
"evidence": "/affected/2/versions"
},
{
"value": "1.8.4-5ubuntu0.1~esm3",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.10.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "1.10.0-4",
"evidence": "/affected/3/versions"
},
{
"value": "1.10.0-4ubuntu0.1",
"evidence": "/affected/3/versions"
},
{
"value": "1.10.0-4ubuntu0.2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.10.0-5",
"evidence": "/affected/4/versions"
},
{
"value": "1.11.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "1.11.0-1ubuntu0.1~esm1",
"evidence": "/affected/4/versions"
},
{
"value": "1.11.0-1ubuntu0.1~esm2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.11.1-2.1",
"evidence": "/affected/5/versions"
},
{
"value": "1.11.1-3",
"evidence": "/affected/5/versions"
},
{
"value": "1.11.1-3ubuntu0.1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.11.2-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.11.3-1",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "tinyproxy",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.11.2-1",
"evidence": "/affected/8/versions"
},
{
"value": "1.11.2-1build1",
"evidence": "/affected/8/versions"
},
{
"value": "1.11.3-1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2026-54387",
"aliases": [
"UBUNTU-CVE-2026-54387"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"1.8.3-3ubuntu1",
"1.8.3-3ubuntu14.04.1~esm1",
"1.8.3-3ubuntu14.04.1~esm2",
"1.8.3-3ubuntu14.04.1~esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.8.3-3ubuntu14.04.1~esm3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"1.8.3-3ubuntu1",
"1.8.3-3ubuntu16.04.1~esm1",
"1.8.3-3ubuntu16.04.1~esm2",
"1.8.3-3ubuntu16.04.1~esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.8.3-3ubuntu16.04.1~esm3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"1.8.4-2",
"1.8.4-3",
"1.8.4-5",
"1.8.4-5ubuntu0.1~esm1",
"1.8.4-5ubuntu0.1~esm2",
"1.8.4-5ubuntu0.1~esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.8.4-5ubuntu0.1~esm3"
},
{
"binary_name": "tinyproxy-bin",
"binary_version": "1.8.4-5ubuntu0.1~esm3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.10.0-2",
"1.10.0-4",
"1.10.0-4ubuntu0.1",
"1.10.0-4ubuntu0.2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.10.0-4ubuntu0.2"
},
{
"binary_name": "tinyproxy-bin",
"binary_version": "1.10.0-4ubuntu0.2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"1.10.0-5",
"1.11.0-1",
"1.11.0-1ubuntu0.1~esm1",
"1.11.0-1ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.11.0-1ubuntu0.1~esm2"
},
{
"binary_name": "tinyproxy-bin",
"binary_version": "1.11.0-1ubuntu0.1~esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.11.1-2.1",
"1.11.1-3",
"1.11.1-3ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.11.1-3ubuntu0.1"
},
{
"binary_name": "tinyproxy-bin",
"binary_version": "1.11.1-3ubuntu0.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.11.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.11.2-1"
},
{
"binary_name": "tinyproxy-bin",
"binary_version": "1.11.2-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.11.3-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.11.3-1"
},
{
"binary_name": "tinyproxy-bin",
"binary_version": "1.11.3-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyproxy",
"purl": "pkg:deb/ubuntu/tinyproxy?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.11.2-1",
"1.11.2-1build1",
"1.11.3-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54387.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tinyproxy",
"binary_version": "1.11.3-1"
},
{
"binary_name": "tinyproxy-bin",
"binary_version": "1.11.3-1"
}
]
}
}
],
"modified": "2026-10-17T12:58:36.159534013Z",
"provider": "osv",
"upstream": [
"CVE-2026-54387"
],
"references": [
"https://ubuntu.com/security/CVE-2026-54387",
"https://www.cve.org/CVERecord?id=CVE-2026-54387",
"https://github.com/tinyproxy/tinyproxy/issues/609",
"https://github.com/tinyproxy/tinyproxy/pull/610"
]
},
"related_cves": [
{
"value": "CVE-2026-54387",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 358847,
"published_at": "2026-06-17T20:17:00+00:00"
}