Bug 2570318 (CVE-2026-125371) - CVE-2026-125371 tinyproxy: Tinyproxy: Access control bypass via improper hostname matching
Summary: CVE-2026-125371 tinyproxy: Tinyproxy: Access control bypass via improper host...
Keywords:
Status: NEW
Alias: CVE-2026-125371
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2572404 2572406
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-10 19:50 UTC by OSIDB Bzimport
Modified: 2026-11-12 13:55 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-10 19:50:39 UTC 
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
Note You need to log in before you can comment on or make changes to this bug.