CVE-2026-125371

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-125371", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-09T22:03:04.330Z", "datePublished": "2026-11-09T23:27:42.645Z", "dateUpdated": "2026-11-10T19:06:17.445Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-09T23:27:42.645Z"}, "datePublic": "2026-09-14T00:00:00.000Z", "title": "Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match", "descriptions": [{"lang": "en", "value": "Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Partial String Comparison", "cweId": "CWE-187", "type": "CWE"}]}], "affected": [{"vendor": "tinyproxy", "product": "tinyproxy", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.11.3", "status": "affected", "versionType": "semver"}, {"version": "3991ac8f98c6a9f05b3265018b812dbf2ca92c28", "status": "unaffected", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tinyproxy_project:tinyproxy:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.11.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/tinyproxy/tinyproxy/issues/627", "tags": ["issue-tracking"], "name": "GitHub Issue #627"}, {"url": "https://github.com/tinyproxy/tinyproxy", "tags": ["product"]}, {"url": "https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174", "tags": ["technical-description"]}, {"url": "https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28", "tags": ["patch"]}, {"name": "VulnCheck Advisory: Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match"}], "credits": [{"lang": "en", "value": "Yuri Bichuk", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T18:18:46.899685Z", "id": "CVE-2026-125371", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T19:06:17.445Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-125371", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-09T22:03:04.330Z", "datePublished": "2026-11-09T23:27:42.645Z", "dateUpdated": "2026-11-10T19:06:17.445Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-09T23:27:42.645Z"}, "datePublic": "2026-09-14T00:00:00.000Z", "title": "Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match", "descriptions": [{"lang": "en", "value": "Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Partial String Comparison", "cweId": "CWE-187", "type": "CWE"}]}], "affected": [{"vendor": "tinyproxy", "product": "tinyproxy", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.11.3", "status": "affected", "versionType": "semver"}, {"version": "3991ac8f98c6a9f05b3265018b812dbf2ca92c28", "status": "unaffected", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tinyproxy_project:tinyproxy:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.11.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/tinyproxy/tinyproxy/issues/627", "tags": ["issue-tracking"], "name": "GitHub Issue #627"}, {"url": "https://github.com/tinyproxy/tinyproxy", "tags": ["product"]}, {"url": "https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174", "tags": ["technical-description"]}, {"url": "https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28", "tags": ["patch"]}, {"name": "VulnCheck Advisory: Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match"}], "credits": [{"lang": "en", "value": "Yuri Bichuk", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-125371", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T18:18:46.899685Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T18:18:48.029Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "tinyproxy", "vendor": "tinyproxy", "versions": [{"lessThanOrEqual": "1.11.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "3991ac8f98c6a9f05b3265018b812dbf2ca92c28", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs."}], "id": "CVE-2026-125371", "lastModified": "2026-11-12T20:28:31.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-125371", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T18:18:46.899685Z", "version": "2.0.3"}}]}, "published": "2026-11-10T00:17:09.420", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/tinyproxy/tinyproxy"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/tinyproxy/tinyproxy/issues/627"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-187"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "tinyproxy: Tinyproxy: Access control bypass via improper hostname matching", "id": "2570318", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570318"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-1025", "details": ["Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.", "A flaw was found in Tinyproxy. The proxy server improperly validates client hostnames against access control lists (ACLs) by matching trailing characters without verifying Domain Name System (DNS) label boundaries. A remote attacker who controls reverse DNS pointer (PTR) records for their IP address can craft a hostname that matches the end of an allowed domain, bypassing access restrictions to unauthorizedly route traffic through the proxy."], "mitigation": {"lang": "en:us", "value": "To mitigate this flaw, configure Tinyproxy to enforce access controls strictly using IP addresses or CIDR subnets rather than hostnames or domain names.\n1. Edit `/etc/tinyproxy/tinyproxy.conf` to replace any domain-based `Allow` or `Deny` directives with explicit IP addresses or subnets:\n```\n# Avoid hostname entries such as 'Allow example.com'\nAllow 192.168.1.0/24\nAllow 10.0.0.0/8\n```\n2. Additionally, restrict access to the Tinyproxy listening port (default 8888/tcp) at the firewall level using firewalld to ensure only authorized subnets can reach the service:\n```\nfirewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24\nfirewall-cmd --reload\n```\n3. Apply configuration changes by restarting the service:\n```\nsystemctl restart tinyproxy\n```\nWarning: Restarting or reloading the Tinyproxy service will terminate active client connections. Relying solely on IP-based ACLs requires administrative overhead to maintain accurate client IP allocations."}, "name": "CVE-2026-125371", "public_date": "2026-11-09T23:27:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-125371\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-125371\nhttps://github.com/tinyproxy/tinyproxy\nhttps://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174\nhttps://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28\nhttps://github.com/tinyproxy/tinyproxy/issues/627\nhttps://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match"], "statement": "This vulnerability is rated as having Moderate impact because exploitation requires specific non-default access control configurations using domain names rather than IP addresses, along with control over external reverse DNS records. When Tinyproxy is deployed to restrict proxy clients using hostname-based allow lists, an attacker capable of manipulating PTR records for their originating address can bypass filtering to route requests through the proxy. The flaw does not allow remote code execution or direct compromise of the host system, and deployments enforcing ACLs strictly via IP addresses or subnets are unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.11.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "3991ac8f98c6a9f05b3265018b812dbf2ca92c28"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "tinyproxy", "source": "cna", "vendor": "tinyproxy"}, "product": "tinyproxy", "vendor": "tinyproxy_project"}], "created": "2026-11-10T00:30:20.396960+00:00", "updated": "2026-11-10T00:30:20.936609+00:00", "vendors": ["tinyproxy_project", "tinyproxy_project$PRODUCT$tinyproxy"]}