CVE-2026-125371 Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125371?
CVE-2026-125371 is a medium-severity vulnerability in tinyproxy, published on 9 Nov 2026.
Official description
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
Weakness: CWE-187
Which versions are affected by CVE-2026-125371?
How do I fix CVE-2026-125371?
No fix has been published for CVE-2026-125371 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125371 being exploited?
There is no known exploitation of CVE-2026-125371 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-125371, GHSA-qwr3-mfw3-8qfr, UBUNTU-CVE-2026-125371.