{"id":"CVE-2026-31842","title":"Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c","summary":"Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value a…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-444"],"vendor":"tinyproxy_project","product":"tinyproxy","affected":["tinyproxy <= 1.11.3"],"published":"2026-04-07","updated":"2026-08-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31842","references":[{"url":"https://datatracker.ietf.org/doc/html/rfc7230","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"},{"url":"https://github.com/tinyproxy/tinyproxy","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"},{"url":"https://github.com/tinyproxy/tinyproxy/issues/604","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"tags":["nvd"],"epss":0.00743,"epssPercentile":0.52699,"ingestedAt":"2026-08-10T12:39:46.453Z","slug":"CVE-2026-31842","body":"## Overview\n\nTinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against \"chunked\", even though RFC 7230 specifies that transfer-coding names are case-insensitive.\n\n## Affected\n\n- `tinyproxy <= 1.11.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}