Access Control Bypass in Tinyproxy Affects Security Features

CVE-2026-125371

What is CVE-2026-125371?

Tinyproxy versions up to 1.11.3 are affected by a vulnerability that allows attackers to bypass access controls. This flaw is located in the acl_string_processing() function, where the system erroneously compares only the trailing characters of hostnames without properly checking the DNS label boundaries. Consequently, an attacker who controls the PTR record for their source IP can exploit this weakness to gain unauthorized access, even when the ACLs are configured to deny by default.

References