Approved changes feed: RSS · Atom
cpe:2.3:a:tinyproxy_project:tinyproxy:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Tinyproxy Project (ecba1455-84c8-553d-b249-df2d320382ca) |
|---|---|
| Product | Tinyproxy (7ec006e9-014e-50f8-9eab-4482677997de) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/tinyproxy |
purl2cpe | 2026-06-01 10:11:56.632202 |
pkg:deb/ubuntu/tinyproxy |
purl2cpe | 2026-06-01 10:11:56.632204 |
pkg:github/tinyproxy/tinyproxy |
purl2cpe | 2026-06-01 10:11:56.632205 |
pkg:rpm/fedora/tinyproxy |
purl2cpe | 2026-06-01 10:11:56.632206 |
pkg:rpm/opensuse/tinyproxy |
purl2cpe | 2026-06-01 10:11:56.632208 |
pkg:sourceforge/tinyproxy |
purl2cpe | 2026-06-01 10:11:56.632209 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-55202 |
vulnerable | 2026-07-29 01:00:28.395731 |
Tinyproxy - Stathost Detection Bypass via Host Header Manipulation
HIGH (8.2)
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
Published: 2026-06-17T19:13:45.383Z
Updated: 2026-11-08T14:05:23.113Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31842 |
vulnerable | 2026-06-08 07:57:15.966298 |
Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling
HIGH (7.5)
Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.
Published: 2026-04-07T11:17:33.621Z
Updated: 2026-08-10T11:43:29.288Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63938 |
vulnerable | 2026-06-08 07:39:17.863116 |
Details available
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.
Published: 2025-11-26T00:00:00.000Z
Updated: 2025-11-26T16:45:07.159Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-40468 |
vulnerable | 2026-06-08 05:48:24.967944 |
Details available
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.
Published: 2022-09-19T00:00:00.000Z
Updated: 2025-11-04T16:09:53.843Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-11747 |
vulnerable | 2026-06-08 05:08:38.382978 |
Details available
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a "kill `cat /run/tinyproxy/tinyproxy.pid`" command.
Published: 2017-07-30T16:00:00.000Z
Updated: 2024-08-05T18:19:38.909Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.