DEBIAN-CVE-2026-125371: Medium severity debian/tinyproxy vulnerability

Published Nov 10, 2026

Updated

Tinyproxy through 1.11.3 contains an access control bypass vulnerability in aclstringprocessing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.

Affected Software

3 affected components

debian/tinyproxy*

Event History

Nov 10, 2026

CVE Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this bypass?

Tinyproxy deployments that rely on hostname-based Allow ACL entries and deny by default are exposed. An entry such as "Allow trusted.net" can be bypassed by a client whose reverse DNS name merely ends in that string, such as "untrusted.net".

What does an attacker need to exploit it?

The attacker needs to connect from a source IP address whose PTR record they control or can influence. They must set that reverse-DNS hostname to a value ending in an allowed hostname string without being within the intended DNS domain.

How can administrators reduce risk if they cannot patch immediately?

Avoid hostname-based Allow ACL entries where possible, especially suffix-style trusted domain names. Restrict proxy access using controls that do not depend on reverse-DNS hostname matching.

DEBIAN-CVE-2026-125371: Medium severity debian/tinyproxy vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this bypass?

What does an attacker need to exploit it?

How can administrators reduce risk if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this bypass?

What does an attacker need to exploit it?

How can administrators reduce risk if they cannot patch immediately?