From dbd6ccb0175da77556187fadcf2d8354a4d50300 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Fri, 31 Jul 2026 07:56:01 +0200
Subject: [PATCH] tinyproxy: fix CVE-2026-54387, CVE-2026-54388 and
 CVE-2026-55202

Apply upstream fixes for ambiguous HTTP request framing and inconsistent stathost authentication and routing. No upstream release containing these fixes is available.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 4d53f69eb7681739a0811914d7f47addd6fac7ff)
---
 pkgs/by-name/ti/tinyproxy/package.nix | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ti/tinyproxy/package.nix b/pkgs/by-name/ti/tinyproxy/package.nix
index 035c3194b91e..bb07a0bf0a4d 100644
--- a/pkgs/by-name/ti/tinyproxy/package.nix
+++ b/pkgs/by-name/ti/tinyproxy/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
+  fetchpatch,
   autoreconfHook,
   perl,
   nixosTests,
@@ -22,10 +22,26 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # Fix case-sensitive matching of "chunked" (CVE-2026-31842)
-    (fetchpatch2 {
+    (fetchpatch {
       name = "fix-chunked-case-sensitivity.patch";
       url = "https://github.com/tinyproxy/tinyproxy/commit/879bf844abffa0bf5fae6aff0c73179024dd9f98.patch";
-      hash = "sha256-Nav3nXyxdoM/tIvfyPJHEYEjAtrRrJlvkMXzsQCZan4=";
+      hash = "sha256-kU9Vqf2YtnKNJU4eQlau/ijtXkGPS/n+YSeficfu7JM=";
+    })
+    # Remove when updating to the first upstream release containing these fixes.
+    (fetchpatch {
+      name = "CVE-2026-54387.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/623bfc093df009296f0b85d40bc677ef9d5c09bb.patch";
+      hash = "sha256-BSnK3XkBFW43cnD937RKr7FJzQT90BxJkILXz/QPZo8=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-54388.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb.patch";
+      hash = "sha256-+Z/Rj/zNldfOPVzWUlFHa37LEfSh/PtXOaN8z++ONJQ=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-55202.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce.patch";
+      hash = "sha256-kwYk5E95KQK42ebLV0nHB706VynDnjHB/5eENKO7Eaw=";
     })
   ];