CVE-2026-31842

OVERVIEW CVE-2026-31842 is a HTTP request parsing desynchronization vulnerability affecting Tinyproxy through version 1.11.3. The vulnerability stems from a case-sensitive comparison of the Transfer-Encoding header in the is_chunked_transfer() function, which violates RFC 7230 specifications requiring case-insensitive header comparison. An attacker can exploit this by sending requests with "Transfer-Encoding: Chunked" (capitalized) to cause Tinyproxy to misinterpret the request as having no body, leading to inconsistent parsing between Tinyproxy and RFC-compliant backend servers. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication, low attack complexity, and high availability impact. The primary consequence is application-level denial of service through indefinite connection hangs that exhaust backend worker resources. A secondary impact exists in deployments using Tinyproxy for request inspection or security filtering, where the unread request body may bypass security controls without proper validation. The EPSS score of 0.00061 indicates this is currently a low-probability exploitation event. EXPLOITATION STATUS There is no current evidence of active exploitation, with the vulnerability not appearing on CISA's Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is marked as inactive on the Hot List, and no public exploit code availability has been reported. Community attention remains minimal based on available indicators, though the moderate FAUCET Risk Score of 48.0 suggests organizations should prioritize patching to prevent potential future exploitation.