Host Header Injection Vulnerability in Tinyproxy by Tinyproxy Team

CVE-2026-55202

What is CVE-2026-55202?

Tinyproxy versions up to 1.11.3 are susceptible to a vulnerability that fails to adequately validate the Host header during stat host detection. This flaw enables unauthenticated attackers to manipulate requests by injecting a custom Host header, allowing access to the statistics page. Furthermore, attackers can bypass detection mechanisms through port manipulation, leading to unauthorized access to sensitive internal statistics or using the proxy to misroute connections. This vulnerability necessitates prompt attention to mitigate potential abuse through transparent proxy connections that evade existing access controls.

References