CVE-2026-125371
Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
| CWE | CWE-187 |
| Vendor | tinyproxy |
| Product | tinyproxy |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for tinyproxy tinyproxy
Be the first to know when new medium vulnerabilities affecting tinyproxy tinyproxy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
tinyproxy / tinyproxy
0 ≤ 1.11.3
References
github.com: https://github.com/tinyproxy/tinyproxy/issues/627 github.com: https://github.com/tinyproxy/tinyproxy github.com: https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174 github.com: https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28 vulncheck.com: https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match
Credits
Yuri Bichuk