Tinyproxy_project Tinyproxy
5 CVEs affecting Tinyproxy_project Tinyproxy. Latest disclosed: 2026-04-07. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49606 | Critical | 9.8 | 2024-05-01 | A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trig… |
CVE-2026-31842 | High | 7.5 | 2026-04-07 | Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs… |
CVE-2022-40468 | High | 7.5 | 2022-09-19 | Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier u… |
CVE-2025-63938 | Medium | 6.5 | 2025-11-26 | Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. |
CVE-2017-11747 | Medium | 5.5 | 2017-07-30 | main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local user… |