THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-31842 (HIGH 7.5) — Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 spec

[NVD] CVE-2026-31842 (HIGH 7.5) — Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 spec

lownvdPublished 2026-04-07

CVE-2026-31842 CVSS: 7.5 HIGH Published: 2026-04-07T12:16:21.040

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.

Indicators of compromise

CVE-2026-31842cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-31842