tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-En…

CVE-2026-66752 affects tiny-http through version 0.12.0, exposing a critical HTTP request smuggling vulnerability. The flaw stems from improper handling of the Transfer-Encoding header, where the library unconditionally applies chunk-decoding for any Transfer-Encoding value and discards Content-Length. Remote attackers can exploit the discrepancy between tiny-http's parsing behavior and a correctly-implemented front-end proxy to produce two distinct interpretations of a single byte stream, enabling classic request smuggling attacks. Additionally, attackers can send non-chunked bodies with non-chunked Transfer-Encoding values to cause failed body reads, tying up connections and consuming worker threads without signaling errors to clients. This can lead to denial of service through resource exhaustion. The vulnerability is exploitable remotely without authentication. Proof-of-concept code is publicly available on GitHub, increasing the risk of exploitation.