Attack Chain

1. The attacker sends a crafted HTTP request to the Tinyproxy server. The request includes a Transfer-Encoding header with a case variation of "chunked", such as "Chunked".
2. Tinyproxy's is_chunked_transfer() function in src/reqs.c uses strcmp() to compare the header value against "chunked".
3. Due to the case-sensitive comparison, the header value does not match "chunked", and Tinyproxy misinterprets the request as not using chunked transfer encoding.
4. Tinyproxy sets content_length.client to -1 and skips the pull_client_data_chunked() function.
5. Tinyproxy forwards the request headers upstream to the backend server.
6. Tinyproxy transitions into relay_connection(), initiating raw TCP forwarding of data. However, unread body data remains buffered on the Tinyproxy server.
7. The backend server, expecting a chunked request body, waits indefinitely for the remaining data, leading to a hung connection.
8. Repeated exploitation exhausts backend server resources, resulting in application-level denial of service. In scenarios involving request inspection, uninspected data is forwarded, bypassing security controls.

Impact

Successful exploitation of CVE-2026-31842 can lead to application-level denial of service due to backend worker exhaustion. RFC-compliant backend servers, such as Node.js or Nginx, will indefinitely wait for chunked body data, consuming resources. In deployments where Tinyproxy is used for security enforcement (request body inspection, filtering), the vulnerability allows attackers to bypass these controls by sending uninspected data to the backend server. The specific number of affected installations is unknown, but all deployments of Tinyproxy versions 1.11.3 and earlier are vulnerable.

Recommendation

• Upgrade Tinyproxy to a patched version that addresses the case-sensitive comparison of the Transfer-Encoding header (check the vendor website for the latest version).
• Deploy the Sigma rule "Detect Case-Variant Transfer-Encoding Header" to detect exploitation attempts in real-time by monitoring web server logs for requests with malformed Transfer-Encoding headers.
• Monitor Tinyproxy's logs for unusual connection patterns or error messages that may indicate exploitation attempts.
• Implement web application firewall (WAF) rules to normalize or reject requests with non-standard Transfer-Encoding headers, mitigating the vulnerability at the perimeter.