Tinyproxy Project vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Tinyproxy Project products: 2 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-31842 High · 7.5 CWE-444 Apr 7, 2026

Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.

CVE-2025-63938 Medium · 6.5 CWE-190 Nov 26, 2025

Integer Overflow or Wraparound in Tinyproxy Project Tinyproxy

Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.