CVE-2026-55202
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Tinyproxy through version 1.11.3 fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
Risk Assessment
The organization is at risk of leaking sensitive network traffic information and bypassing access control mechanisms, potentially leading to unauthorized access to internal resources.
Recommendation
Immediately update Tinyproxy to a version containing commit 09312a1 or later, which fixes this vulnerability. If an update is not possible, restrict access to the stats page using firewall rules.
Other vulnerabilities in Tinyproxy
See all- CVE-2026-54388Critical
Tinyproxy through version 1.11.3 fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable cache poisoning, access control bypass, and request hijacking.
- CVE-2026-54387Critical
Tinyproxy up to version 1.11.3 fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both to the backend while using Content-Length to determine request body bytes. Remote attackers can desynchronize proxy and backend parser states, enabling injection of arbitrary HTTP requests to the backend.
- CVE-2026-31842High
Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.
- CVE-2026-3945High
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
Original NVD description (English source)
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.