CVE-2026-125371 · Runtime
NO FIX YET
Tinyproxy compares only the trailing characters of a client's reverse DNS name against allowed hostnames, without checking label boundaries. An attacker who controls the PTR record for their IP can use a name like untrusted.net to match an allow rule for trusted.net and use the proxy.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Tinyproxy with hostname-based Allow rules are exposed, because the flaw only matters when an access rule names a hostname. Deployments that allow access only by IP address or CIDR range are not affected by this flaw. The sources do not give the fixed version beyond the patch link, so check the upstream commit for the exact release.
Not affected if deny-by-default-not-hostname, ip-only-acl
Who cares linux, self-hosted, tinyproxy
tinyproxy -v to read the installed version, and check whether it is 1.11.3 or earlier.tinyproxy.conf for Allow lines that use hostnames rather than IP addresses or CIDR ranges.Allow entries with hostnames are present in your configuration.No fix yet, per the sources.
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.