Vulnerability DatabaseCVE-2026-125371
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-125371
Published:November 09, 2026
Updated:November 10, 2026
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
Related Resources (7)
https://nvd.nist.gov/vuln/detail/CVE-2026-125371
https://github.com/tinyproxy/tinyproxy/issues/627
https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174
https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125371.json
https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28
https://github.com/tinyproxy/tinyproxy
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.8
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Partial String Comparison
CWE-187