A critical HTTP request smuggling vulnerability in Tinyproxy allows unauthenticated attackers to bypass security controls or cause application-level denial of service.

The application incorrectly performs a case-sensitive comparison of the Transfer-Encoding header against the value "chunked". Because this comparison violates RFC 7230, an unauthenticated attacker can supply a malformed header, such as "Chunked", to desynchronize the proxy from the backend server.

This vulnerability presents a high risk to organizational security, as it allows attackers to bypass Web Application Firewalls (WAF) and other inspection layers that rely on accurate HTTP parsing. By smuggling malicious payloads or triggering backend connection hangs, an attacker can compromise data integrity, bypass access controls, or render critical web services unavailable. The CVSS score of 7.5 reflects the potential for significant impact on service availability and the ability to evade security monitoring.

Immediate Action: Upgrade to a patched version of Tinyproxy that replaces the case-sensitive strcmp function with a case-insensitive comparison, such as strcasecmp.

Proactive Monitoring: Review access logs for unusual HTTP request patterns, specifically those involving mixed-case Transfer-Encoding headers or requests that result in hanging backend connections.

Compensating Controls: Implement strict input validation at the edge and ensure that downstream backend servers are configured to reject or normalize requests with malformed or ambiguous transfer-coding headers.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the GitHub issue tracker provided by the research community.

Given the availability of technical details and the potential for bypassing security defenses, this vulnerability should be prioritized for immediate remediation. Organizations using Tinyproxy must update their software promptly to eliminate the risk of request smuggling and the associated potential for service disruption.