CVE-2026-66752

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:05+00:00| seen| Telegram/nMUaw2zZXyCly-Bqsn7kRIsLFdlVwXx5RzNb6RunyMxeZuU 2026-09-23 00:00:25+00:00| published-proof-of-concept| Telegram/nMUaw2zZXyCly-Bqsn7kRIsLFdlVwXx5RzNb6RunyMxeZuU...

📄 tiny_http 0.12.0 HTTP Request Smuggling

tinyhttp versions 0.12.0 and earlier contain an HTTP request smuggling vulnerability caused by improper handling of the Transfer-Encoding header. The library checks only for the presence of the header rather than validating its value, allowing inconsistent HTTP request parsing between front-end...

CVE-2026-66752

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...

UBUNTU-CVE-2026-66752

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...