CVE-2026-125371: Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in aclstringprocessing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using Tinyproxy through 1.11.3 are exposed when their ACL configuration uses hostname-based Allow entries, such as "Allow trusted.net", in a deny-by-default policy.
What does an attacker need to exploit it?
The attacker needs to connect from a source IP whose PTR record they control. They can set a PTR hostname such as "untrusted.net", which ends in the allowed string "trusted.net" without belonging to that DNS domain.
What can be done if an update is not immediately available?
Avoid hostname suffix Allow rules for access control and restrict allowed clients using IP-based ACL entries or network-level controls instead. This prevents attacker-controlled PTR hostnames from matching an intended trusted hostname suffix.