Back Linuxsecurity

Fedora 43 tinyproxy Important HTTP Request Smuggling Fix 2026

Linuxsecurity •LinuxSecurity Advisories • June 27, 2026

* Thu Jun 18 2026 Carl George - 1.11.2-8 - Backport upstream CVE fixes - Fixes CVE-2026-54387 - Fixes CVE-2026-54388

[ 1 ] Bug #2490299 - CVE-2026-54387 tinyproxy: HTTP Request Smuggling via CL/TE desynchronization [fedora-all] [ 2 ] Bug #2490301 - CVE-2026-54388 tinyproxy: HTTP Request Smuggling via duplicate Content-Length headers [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-77f1ca9c8f' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical HTTP Request Smuggling Vulnerabilities in Fedora Tinyproxy On June 18, 2026, Fedora released updates for tinyproxy addressing two critical HTTP Request Smuggling vulnerabilities, CVE-2026-54387 and CVE-2026-54388, both published on June 17, 2026. These vulnerabilities affect Fedora 43 and 44, allowing attackers to exploit CL/TE desynchronization and duplicate Content-Length headers. The flaws could lead to significant security risks, including unauthorized access and data manipulation. Users are urged to apply the updates immediately to mitigate potential exploitation. The updates can be installed using the 'dnf' package manager. The vulnerabilities were backported from upstream fixes by Carl George. The scope of impact includes all Fedora users running affected versions of tinyproxy. Current status indicates that patches are available and should be applied promptly. 2 sources 72

Extracted Entities

Fedora 43 tinyproxy Important HTTP Request Smuggling Fix 2026

The full story

Extracted Entities

Companies (1)

CVEs (2)

Vulnerabilities (1)