Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp() to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive. By sending a request with Transfer-Encoding: Chunked, an unauthenticated remote attacker can cause Tinyproxy to misinterpret the request as having no body. In this state, Tinyproxy sets content_length.client to -1, skips pull_client_data_chunked(), forwards request headers upstream, and transitions into relay_connection() raw TCP forwarding while unread body data remains buffered. This leads to inconsistent request state between Tinyproxy and backend servers. RFC-compliant backends (e.g., Node.js, Nginx) will continue waiting for chunked body data, causing connections to hang indefinitely. This behavior enables application-level denial of service through backend worker exhaustion. Additionally, in deployments where Tinyproxy is used for request-body inspection, filtering, or security enforcement, the unread body may be forwarded without proper inspection, resulting in potential security control bypass.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9695fbdabb advisory.

    Backport upstream fixes for CVE-2026-3945 and CVE-2026-31842.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d67a979089 advisory.

    Backport upstream fixes for CVE-2026-3945 and CVE-2026-31842.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d8daf8790f advisory.

    Backport upstream fixes for CVE-2026-3945 and CVE-2026-31842.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive     comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp()     to compare the header value against chunked, even though RFC 7230 specifies that transfer-coding names     are case-insensitive. By sending a request with Transfer-Encoding: Chunked, an unauthenticated remote     attacker can cause Tinyproxy to misinterpret the request as having no body. In this state, Tinyproxy sets     content_length.client to -1, skips pull_client_data_chunked(), forwards request headers upstream, and     transitions into relay_connection() raw TCP forwarding while unread body data remains buffered. This leads     to inconsistent request state between Tinyproxy and backend servers. RFC-compliant backends (e.g.,     Node.js, Nginx) will continue waiting for chunked body data, causing connections to hang indefinitely.
    This behavior enables application-level denial of service through backend worker exhaustion. Additionally,     in deployments where Tinyproxy is used for request-body inspection, filtering, or security enforcement,     the unread body may be forwarded without proper inspection, resulting in potential security control     bypass. (CVE-2026-31842)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c7a717dbc advisory.

    Automatic update for tinyproxy-1.11.3-2.fc45.

    ##### **Changelog**

    ```
    * Wed Apr  8 2026 Carl George <carlwgeorge@fedoraproject.org> - 1.11.3-2
    - Backport upstream CVE fixes
    - Fixes rhbz#2452969 CVE-2026-3945
    - Fixes rhbz#2455913 CVE-2026-31842
    - Run upstream test suite

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
310435	Fedora 44 : tinyproxy (2026-9695fbdabb)	Nessus	Fedora Local Security Checks	high
309737	Fedora 42 : tinyproxy (2026-d67a979089)	Nessus	Fedora Local Security Checks	high
307695	Fedora 43 : tinyproxy (2026-d8daf8790f)	Nessus	Fedora Local Security Checks	high
305791	Linux Distros Unpatched Vulnerability : CVE-2026-31842	Nessus	Misc.	high
305657	Fedora 45 : tinyproxy (2026-1c7a717dbc)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2026-31842

high

Tenable Plugins

high

high

high

high

high