CVE-2026-55202

Name	CVE-2026-55202
Description	Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tinyproxy (PTS)	bullseye	1.10.0-5	vulnerable
	bullseye (security)	1.10.0-5+deb11u1	vulnerable
	bookworm, bookworm (security)	1.11.1-2.1+deb12u1	vulnerable
	trixie	1.11.2-1	vulnerable
	sid, forky	1.11.3-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
tinyproxy	source	(unstable)	(unfixed)

Notes

[trixie] - tinyproxy <no-dsa> (Minor issue)
https://github.com/tinyproxy/tinyproxy/pull/606
Fixed by: https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce