Filtered by vendor Tinyproxy Subscriptions

Search

Switch to Advanced Search (Beta)
Total 8 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-3945 1 Tinyproxy 1 Tinyproxy 2026-08-10 7.5 High
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
CVE-2026-54388 2 Tinyproxy, Tinyproxy Project 2 Tinyproxy, Tinyproxy 2026-07-14 9.1 Critical
Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
CVE-2026-54387 2 Tinyproxy, Tinyproxy Project 2 Tinyproxy, Tinyproxy 2026-07-14 9.1 Critical
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
CVE-2026-55202 2 Tinyproxy, Tinyproxy Project 2 Tinyproxy, Tinyproxy 2026-06-23 8.2 High
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
CVE-2001-0129 1 Tinyproxy 1 Tinyproxy 2026-04-16 N/A
Buffer overflow in Tinyproxy HTTP proxy 1.3.3 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long connect request.
CVE-2002-0847 1 Tinyproxy 1 Tinyproxy 2026-04-16 N/A
tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free).
CVE-2025-63938 2 Tinyproxy, Tinyproxy Project 2 Tinyproxy, Tinyproxy 2026-01-02 6.5 Medium
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.
CVE-2023-49606 2 Tinyproxy, Tinyproxy Project 2 Tinyproxy, Tinyproxy 2025-11-04 9.8 Critical
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.