Critical USN-7190-1 1 CVE

tinyproxy vulnerability

Published Jan 8, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Tinyproxy did not properly manage memory during the
parsing of HTTP connection headers. An attacker could use this issue to
cause a DoS or possibly execute arbitrary code.

Fixed packages 6

Release	Package	Fixed in
Ubuntu · 20.04 LTS 20.04:LTS	tinyproxy	1.10.0-4ubuntu0.2
Ubuntu · 24.04 LTS 24.04:LTS	tinyproxy	1.11.1-3ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	tinyproxy	1.8.3-3ubuntu14.04.1~esm3
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	tinyproxy	1.8.3-3ubuntu16.04.1~esm3
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	tinyproxy	1.8.4-5ubuntu0.1~esm3
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS	tinyproxy	1.11.0-1ubuntu0.1~esm2

Vulnerabilities 1

Critical 9.8

CVE-2023-49606 Public exploit Scanner template EPSS 63%

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. …

Tinyproxy Project tinyproxy tinyproxy tinyproxy Debian Ubuntu Alpine

May 1, 2024

References

report
https://ubuntu.com/security/CVE-2023-49606