Description
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tinyproxy | tinyproxy | ≤ 1.11.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tinyproxy | No fix yet | — |
| Debian 13 | tinyproxy | No fix yet | — |
| Debian 12 | tinyproxy | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | tinyproxy | No fix yet | — |
| Ubuntu 26.04 LTS | tinyproxy | No fix yet | — |
| Ubuntu 24.04 LTS | tinyproxy | No fix yet | — |
| Ubuntu 20.04 LTS | tinyproxy | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | tinyproxy | No fix yet | — |
| Ubuntu Pro 18.04 LTS | tinyproxy | No fix yet | — |
| Ubuntu Pro 16.04 LTS | tinyproxy | No fix yet | — |
| Ubuntu Pro 14.04 LTS | tinyproxy | No fix yet | — |
Advisories 1
- WID-SEC-2026-4422 Tinyproxy: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 9, 2026
References
- GitHub Issue #627 issue-tracking
- https://github.com/tinyproxy/tinyproxy product
- https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174 technical-description
- https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28 patch
- VulnCheck Advisory: Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match third-party-advisory