CVE-2026-54387

creationtimestamp| type| source ---|---|--- 2026-06-17 23:23:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojhftygey2v 2026-08-02 15:23:25+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms4c2epkfr2c 2026-08-02 15:48:02+00:00| seen|...

UBUNTU-CVE-2026-54387

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the...