CVE-2026-125371
4.8 MEDIUMpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-187
Public exploit & PoC references
All references
- https://github.com/tinyproxy/tinyproxy
- https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174
- https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28
- https://github.com/tinyproxy/tinyproxy/issues/627
- https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-101914PoC
- MEDIUMCVE-2026-112266PoC
- CRITICALCVE-2026-115646
- MEDIUMCVE-2026-81479
- UNSCOREDCVE-2026-94576
Related by shared AI tags and CWE weakness class. Browse the full archive.