CVE-2023-49606 Use after free in Tinyproxy

What is CVE-2023-49606?

CVE-2023-49606 is a critical use after free vulnerability in Tinyproxy, published on 1 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.

Weakness: CWE-416

Which versions are affected by CVE-2023-49606?

It affects 1 product.

Products include Tinyproxy Project Tinyproxy.

How do I fix CVE-2023-49606?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-49606 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49606 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Tinyproxy

• CVE-2026-31842 Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling High 8.7
• CVE-2022-40468 Information disclosure in n/a High 7.5
• CVE-2025-63938 Integer overflow in n/a Medium 6.5
• CVE-2017-11747 Privilege escalation in n/a Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-49606, DEBIAN-CVE-2023-49606, DSA-5705-1, GHSA-w78j-vw2g-233v, UBUNTU-CVE-2023-49606, USN-7190-1 and 1 more.