Description (CNA)
Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Tinyproxy Project / Tinyproxy | affected 0 through 1.11.3 |
CWE
CWE-444
References
- https://github.com/tinyproxy/tinyproxy/issues/604
- https://github.com/tinyproxy/tinyproxy
- https://datatracker.ietf.org/doc/html/rfc7230
ADP enrichment
No English description supplied.
No references supplied.