{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/tiny-http/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-66752"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["tiny-http \u003c= 0.12.0"],"_cs_severities":["high"],"_cs_tags":["http-request-smuggling","vulnerability","denial-of-service","webserver"],"_cs_type":"advisory","_cs_vendors":["tiny-http"],"content_html":"\u003cp\u003eA remote attacker can exploit CVE-2026-66752, an HTTP request smuggling vulnerability present in tiny-http versions through 0.12.0. This flaw allows an attacker to manipulate how the tiny-http server interprets HTTP requests, particularly when it is behind a front-end proxy that correctly handles HTTP framing. By sending a \u003ccode\u003eTransfer-Encoding\u003c/code\u003e header with any value, even non-chunked ones, the tiny-http library incorrectly applies chunk-decoding and discards the \u003ccode\u003eContent-Length\u003c/code\u003e header. This discrepancy in parsing leads to desynchronization of request framing between the proxy and the vulnerable server, enabling request smuggling attacks. Furthermore, attackers can trigger failed body reads by sending non-chunked bodies with specific \u003ccode\u003eTransfer-Encoding\u003c/code\u003e values, which can exhaust server resources by tying up connections and consuming worker threads without notifying clients, effectively leading to a denial of service.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a web server running tiny-http (version 0.12.0 or earlier) potentially behind a reverse proxy or load balancer.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP request containing a \u003ccode\u003eTransfer-Encoding\u003c/code\u003e header set to a non-chunked value (e.g., \u003ccode\u003eTransfer-Encoding: invalid-encoding\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe request also includes a \u003ccode\u003eContent-Length\u003c/code\u003e header for the initial part of the request.\u003c/li\u003e\n\u003cli\u003eThe front-end proxy correctly processes the \u003ccode\u003eTransfer-Encoding\u003c/code\u003e and \u003ccode\u003eContent-Length\u003c/code\u003e headers according to HTTP specifications and forwards the byte stream to the tiny-http server.\u003c/li\u003e\n\u003cli\u003eThe vulnerable tiny-http server, upon receiving the \u003ccode\u003eTransfer-Encoding\u003c/code\u003e header, unconditionally attempts to apply chunk-decoding and discards the \u003ccode\u003eContent-Length\u003c/code\u003e value.\u003c/li\u003e\n\u003cli\u003eThis misinterpretation causes a desynchronization in request framing between the proxy and the tiny-http server, allowing the tiny-http server to incorrectly interpret subsequent legitimate requests as part of the attacker's initial request (request smuggling).\u003c/li\u003e\n\u003cli\u003eAlternatively, sending a non-chunked body with the specific \u003ccode\u003eTransfer-Encoding\u003c/code\u003e value can trigger failed body reads.\u003c/li\u003e\n\u003cli\u003eThese failed reads exhaust server resources by tying up connections and consuming worker threads, resulting in a denial of service for legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is HTTP request smuggling, which can lead to various further attacks such as bypassing security controls (e.g., WAFs, access controls), cache poisoning, and session hijacking. Additionally, the vulnerability can be exploited for denial of service (DoS), as failed body reads can consume server resources, leading to connection exhaustion and worker thread starvation without providing error feedback to clients. This can render the affected tiny-http based applications unavailable to legitimate users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of tiny-http to a version patched against CVE-2026-66752 immediately to prevent exploitation.\u003c/li\u003e\n\u003cli\u003eReview web server and proxy configurations to ensure they strictly adhere to RFC specifications for HTTP header parsing and request framing, especially concerning \u003ccode\u003eTransfer-Encoding\u003c/code\u003e and \u003ccode\u003eContent-Length\u003c/code\u003e headers, to mitigate HTTP request smuggling risks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T16:22:02Z","date_published":"2026-07-28T16:22:02Z","id":"https://feed.craftedsignal.io/briefs/2026-07-tiny-http-request-smuggling/","summary":"A critical HTTP request smuggling vulnerability (CVE-2026-66752) exists in tiny-http versions up to and including 0.12.0, allowing remote attackers to desynchronize request framing by sending a Transfer-Encoding header with arbitrary values, causing the library to incorrectly apply chunk-decoding and ignore Content-Length, which enables request smuggling attacks and can lead to denial of service by tying up connections and consuming worker threads.","title":"HTTP Request Smuggling Vulnerability in tiny-http CVE-2026-66752","url":"https://feed.craftedsignal.io/briefs/2026-07-tiny-http-request-smuggling/"}],"language":"en","title":"CraftedSignal Threat Feed - Tiny-Http","version":"https://jsonfeed.org/version/1.1"}