CVE-2026-31842: 
NixOS vulnerability analysis and mitigation

CVE-2026-31842 is an HTTP request parsing desynchronization vulnerability in Tinyproxy through version 1.11.3, caused by a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp() to match the header value against "chunked", violating RFC 7230's requirement that transfer-coding names be case-insensitive. This allows unauthenticated remote attackers to trigger backend denial of service or bypass security controls. The vulnerability was disclosed on April 7, 2026, by TuranSec. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Tinyproxy Issue).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). The vulnerable code in src/reqs.c is:

static int is_chunked_transfer (pseudomap *hashofheaders) {
    char *data = pseudomap_find (hashofheaders, "transfer-encoding");
    return data ? !strcmp (data, "chunked") : 0;
}

Because strcmp() is case-sensitive, a request with Transfer-Encoding: Chunked (capital C) is not recognized as chunked. Tinyproxy then sets content_length.client to -1, skips pull_client_data_chunked(), forwards only the headers upstream, and enters relay_connection() raw TCP forwarding mode — leaving the unread body buffered on the client socket. No authentication or special configuration is required; the attack works against any RFC-compliant backend. The fix is to replace strcmp with strcasecmp or normalize the header value before comparison (Tinyproxy Issue).

Exploitation has two primary consequences. First, it enables application-level denial of service: RFC-compliant backends (e.g., Node.js, Nginx) will wait indefinitely for the chunked body that Tinyproxy never forwards, exhausting backend worker connections and rendering the service unavailable. Second, in deployments where Tinyproxy performs request-body inspection, WAF filtering, or ICAP integration, the unread body is blindly relayed via raw TCP without being parsed or inspected, allowing attackers to smuggle payloads past security controls. There is no direct confidentiality or integrity impact on Tinyproxy itself, but the security control bypass could enable downstream attacks (Tinyproxy Issue, GitHub Advisory).

A proof-of-concept exploit is publicly available in the Tinyproxy GitHub issue tracker, consisting of a concrete curl command that reproduces the desynchronization (Tinyproxy Issue). The vulnerability requires no authentication, no special configuration, and has low attack complexity, making it trivially exploitable by any network-accessible attacker. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.046% (low probability of exploitation in the next 30 days) (GitHub Advisory). Detection plugins are available in Nessus (IDs: 305657, 305791, 310435) and Qualys (ID: 288568).

1. Reconnaissance: Identify Tinyproxy instances (version ≤ 1.11.3) exposed on the network using port scanning tools (e.g., nmap) targeting the default Tinyproxy port (8888) or configured proxy ports.
2. Set up a backend listener (optional, for DoS verification): Deploy an RFC-compliant HTTP server (e.g., Node.js or Nginx) behind Tinyproxy that processes chunked request bodies.
3. Craft the malicious request: Send an HTTP request through Tinyproxy using a capitalized Transfer-Encoding: Chunked header combined with a chunked body payload:

   curl -i -x http://<tinyproxy_host>:8888 \
     -H "Transfer-Encoding: Chunked" \
     -H "Content-Length:" \
     --data-binary $'5\r\nadmin\r\n0\r\n\r\n' \
     http://<backend_host>:9000/

4. Trigger desynchronization: Tinyproxy fails to recognize Chunked as chunked encoding, sets content_length.client = -1, skips body parsing, forwards only headers to the backend, and enters raw TCP relay mode.
5. Exhaust backend workers (DoS): Repeat the request in a loop. Each request causes the backend to hang waiting for the chunked body that never arrives, progressively exhausting the backend's worker thread/connection pool.
6. Security bypass (alternative objective): In deployments using Tinyproxy for body inspection or WAF filtering, the unread body is forwarded raw via TCP relay without inspection, allowing malicious payloads to bypass security controls (Tinyproxy Issue).

• Network: Repeated HTTP requests to the Tinyproxy port (default 8888) containing the header Transfer-Encoding: Chunked (capital C) with chunked body data; unusual volume of persistent/hanging connections from Tinyproxy to backend servers.
• Logs: Tinyproxy access logs showing requests with Transfer-Encoding: Chunked that do not complete normally; backend server logs (Node.js, Nginx) showing connections that open and never receive a complete request body, resulting in timeout entries.
• Process/Connection State: High number of backend connections in ESTABLISHED or CLOSE_WAIT state originating from the Tinyproxy process; backend worker thread exhaustion reflected in application-level error logs or health check failures.
• Application Behavior: Backend services becoming unresponsive or returning 503/timeout errors despite Tinyproxy appearing to function normally; WAF or ICAP inspection logs showing no body content for requests that should have bodies (Tinyproxy Issue).

The recommended remediation is to upgrade Tinyproxy to a version beyond 1.11.3 that implements case-insensitive comparison of the Transfer-Encoding header (replacing strcmp with strcasecmp in is_chunked_transfer()). As a network-level workaround, deploy an upstream filter or load balancer that normalizes HTTP headers (lowercasing Transfer-Encoding values) before they reach Tinyproxy, or configure rules to reject requests with non-lowercase Transfer-Encoding values. For deployments relying on Tinyproxy for security enforcement (WAF, ICAP, body inspection), patching should be treated as urgent to prevent security control bypass (GitHub Advisory, Red Hat Bugzilla).

Red Hat opened a tracking bug (Bugzilla #2455893) and assigned it high severity, indicating it affects packages in their ecosystem (Red Hat Bugzilla). The vulnerability was reported by TuranSec as the CNA and disclosed via the Tinyproxy GitHub issue tracker, where the technical details and PoC were made public (Tinyproxy Issue). Coverage appeared on security aggregators including CVEFeed, VulDB, and Infinit Security shortly after disclosure, and the CISA published a vulnerability bulletin referencing it in their weekly summary for the week of April 6, 2026.