CVE-2026-66752: tiny-http HTTP Request Smuggling Flaw

CVE-2026-66752 Overview

CVE-2026-66752 is an HTTP request smuggling vulnerability in the tiny-http Rust library through version 0.12.0. The library unconditionally applies chunk-decoding whenever a Transfer-Encoding header is present, regardless of the header value, and discards the Content-Length header. Attackers can exploit the parsing discrepancy between tiny_http and a compliant front-end proxy to produce two distinct interpretations of the same byte stream. This enables request smuggling and connection resource exhaustion against services built on the library. The issue is classified as CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact
Remote attackers can desynchronize request framing between proxies and tiny_http backends, enabling request smuggling and worker-thread exhaustion without authentication.

Affected Products

tiny-http Rust crate through version 0.12.0
Applications and services embedding tiny_http as their HTTP server
Deployments where tiny_http sits behind an HTTP/1.1-compliant reverse proxy

Discovery Timeline

2026-07-28 - CVE-2026-66752 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66752

Vulnerability Analysis

The vulnerability originates in how tiny_http handles the HTTP/1.1 Transfer-Encoding request header. RFC 9112 requires servers to treat a Transfer-Encoding value as valid only when the final coding is chunked, and to reject or ignore unknown codings. tiny_http instead treats the mere presence of the header as an instruction to apply chunk-decoding, ignoring the actual coding value and discarding any Content-Length header.

When a compliant front-end proxy forwards a request with a non-chunked Transfer-Encoding value, it uses Content-Length to determine the body length. The tiny_http backend, however, reads the same bytes as a chunked stream. This TE.CL desynchronization allows an attacker to smuggle a second request inside the body of the first, bypassing proxy-level access controls and poisoning downstream request queues.

A secondary condition exists where non-chunked bodies sent with non-chunked Transfer-Encoding values cause failed body reads. Connections remain tied up and worker threads are consumed without errors being reported to clients.

Root Cause

The root cause is improper Transfer-Encoding header parsing. The library conflates header presence with chunked semantics and unconditionally strips Content-Length from the request framing decision. This violates the mutually exclusive framing precedence defined in RFC 9112 Section 6.

Attack Vector

Exploitation requires only network access to a service using tiny_http behind a compliant HTTP/1.1 proxy. The attacker sends a crafted request containing both Content-Length and Transfer-Encoding headers, with the Transfer-Encoding value set to a non-chunked coding. Refer to the VulnCheck Security Advisory and the GitHub PoC Repository for concrete request payloads that demonstrate desynchronization and worker-thread exhaustion.

// Verified code example not available.
// See the VulnCheck advisory and public PoC repository linked above
// for reproducible request payloads.

Detection Methods for CVE-2026-66752

Indicators of Compromise

HTTP requests containing both Content-Length and Transfer-Encoding headers reaching tiny_http backends
Transfer-Encoding header values that are not chunked or that specify unknown codings such as identity, xchunked, or cow
Persistent connections to tiny_http workers that hang without returning a response or error
Unexpected request pairs in access logs where a smuggled request appears to originate from the proxy itself

Detection Strategies

Inspect proxy and backend access logs for divergent request counts or body lengths on the same connection
Alert on HTTP/1.1 requests that carry both Transfer-Encoding and Content-Length headers, which RFC 9112 disallows
Fingerprint upstream servers to identify tiny_http deployments and cross-reference the 0.12.0 and earlier version range
Correlate spikes in idle worker threads with anomalous inbound request framing

Monitoring Recommendations

Enable request smuggling detection modules on front-end proxies and WAFs
Monitor worker-thread utilization and connection lifetime distributions on tiny_http services
Capture and periodically audit raw HTTP request framing at the proxy edge
Track upstream response latencies for unusual timeouts that may indicate stalled body reads

How to Mitigate CVE-2026-66752

Immediate Actions Required

Inventory all Rust services that depend on the tiny-http crate and identify versions at or below 0.12.0
Place a compliant reverse proxy in front of tiny_http that rejects requests containing both Content-Length and Transfer-Encoding headers
Configure the proxy to strip or reject any Transfer-Encoding value where the final coding is not chunked
Restrict direct network exposure of tiny_http backends to trusted proxy sources only

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry for CVE-2026-66752. Consult the VulnCheck Security Advisory and the upstream tiny-http repository for updated release information and apply the fixed version once available.

Workarounds

Configure the front-end proxy to normalize or drop malformed Transfer-Encoding headers before forwarding
Enforce HTTP/1.1 strict framing at the proxy and terminate connections that violate RFC 9112
Set aggressive connection and read timeouts on tiny_http workers to limit resource exhaustion from failed body reads
Consider migrating to an alternative Rust HTTP server implementation for internet-exposed workloads until a patched version is released

bash

# Example NGINX configuration to reject conflicting framing headers
map $http_transfer_encoding $te_invalid {
    default 1;
    ""       0;
    "chunked" 0;
}

server {
    listen 443 ssl;
    server_name app.example.com;

    if ($te_invalid) { return 400; }
    if ($http_transfer_encoding != "" ) {
        proxy_set_header Content-Length "";
    }

    location / {
        proxy_http_version 1.1;
        proxy_pass http://tiny_http_backend;
        proxy_read_timeout 15s;
    }
}