Security Advisory

CVE-2026-31842

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-07 11:17:33

Last updated 2026-08-10 11:43:29

Assigner TuranSec

CVSS score 8.7

State PUBLISHED

Description

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.

← Browse all CVEs View on cve.org ↗