Skip to content
Threat Feed
Subscribe

Product

Tiny-Http <= 0.12.0 (<= 0.12.0)

1 brief RSS
high advisory

HTTP Request Smuggling Vulnerability in tiny-http CVE-2026-66752

A critical HTTP request smuggling vulnerability (CVE-2026-66752) exists in tiny-http versions up to and including 0.12.0, allowing remote attackers to desynchronize request framing by sending a Transfer-Encoding header with arbitrary values, causing the library to incorrectly apply chunk-decoding and ignore Content-Length, which enables request smuggling attacks and can lead to denial of service by tying up connections and consuming worker threads.

PoC tiny-http <= 0.12.0 http-request-smuggling vulnerability denial-of-service webserver
1c updated