Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N N H 8.7 .0057 44.9 —
AFFECTED Product Versions Fixed Tinyproxy unspecified —
TIMELINE Mar 9 Reserved by TuranSec Apr 7 Published (CNA: TuranSec) Aug 10 EXPLOIT PUBLISHED — CVE-2026-31842 (Tinyproxy Project Tinyproxy). Public exploit reference added.
Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.
| Date | Event | Detail |
|---|---|---|
| March 9, 2026 | Reserved | Reserved by TuranSec |
| April 7, 2026 | Published | Published (CNA: TuranSec) |
| August 10, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-31842 (Tinyproxy Project Tinyproxy). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Tinyproxy Project | Tinyproxy | — | — | — |
Authoritative record: CVE-2026-31842 at cve.org
Vendors: tinyproxy project
Weaknesses: CWE-444
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-31842 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.