---
id: "CVE-2026-125371"
page: "https://infrastack.ai/live/CVE-2026-125371"
kind: "vulnerability"
aliases: ["CVE-2026-125371"]
title: "Tinyproxy: hostname ACL check lets attackers bypass proxy access control"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux", "runtime", "self-hosted", "tinyproxy"]
not_affected_if: ["deny-by-default-not-hostname", "ip-only-acl"]
published_at: "2026-11-10T00:17:09+00:00"
first_seen_at: "2026-11-10T00:28:42+00:00"
updated_at: "2026-11-10T00:30:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125371", "first_seen_at": "2026-11-10T00:28:42+00:00"}]
exploit_sources: []
---

# Tinyproxy: hostname ACL check lets attackers bypass proxy access control

Link for people: https://infrastack.ai/live/CVE-2026-125371 (this .md is for agents)

Tinyproxy compares only the trailing characters of a client's reverse DNS name against allowed hostnames, without checking label boundaries. An attacker who controls the PTR record for their IP can use a name like untrusted.net to match an allow rule for trusted.net and use the proxy.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `tinyproxy -v` to read the installed version, and check whether it is `1.11.3` or earlier.
- Look in `tinyproxy.conf` for `Allow` lines that use hostnames rather than IP addresses or CIDR ranges.
- Confirm whether `Allow` entries with hostnames are present in your configuration.

## Timeline

- 2026-11-10T00:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125371

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match
- [fix] Patch: github.com https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28

## From the sources

Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_