Tinyproxy Project

tinyproxy_project

5 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (5)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-31842 1Tinyproxy Project 1Tinyproxy Aug 10, 2026 Apr 7, 2026 8.7 HIGH· v4 7.5 HIGH· v3 7.8 HIGH· v2 Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare t...Show more Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.Show less
CVE-2025-63938 1Tinyproxy Project 1Tinyproxy Jun 17, 2026 Nov 26, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.
CVE-2023-49606 1Tinyproxy Project 1Tinyproxy Jun 17, 2026 May 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory c...Show more A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.Show less
CVE-2022-40468 1Tinyproxy Project 1Tinyproxy Jun 17, 2026 Sep 19, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.
CVE-2017-11747 1Tinyproxy Project 1Tinyproxy May 13, 2026 Jul 30, 2017 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this no...Show more main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a "kill `cat /run/tinyproxy/tinyproxy.pid`" command.Show less