CVE-2026-55202

NameCVE-2026-55202
DescriptionTinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1140350

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tinyproxy (PTS)bullseye1.10.0-5fixed
bullseye (security)1.10.0-5+deb11u1fixed
bookworm, bookworm (security)1.11.1-2.1+deb12u1vulnerable
trixie1.11.2-1vulnerable
forky, sid1.11.3-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tinyproxysourcebullseye(not affected)
tinyproxysource(unstable)(unfixed)1140350

Notes

[trixie] - tinyproxy <no-dsa> (Minor issue)
[bookworm] - tinyproxy <postponed> (Minor issue; only exposes the internal stats page, prefix Host match does not bypass BasicAuth verification)
[bullseye] - tinyproxy <not-affected> (Host header based stathost matching introduced in 1.11.0; 1.10.0 only matches the port-stripped host from the request URL)
https://github.com/tinyproxy/tinyproxy/pull/606
Fixed by: https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce
Introduced with: https://github.com/tinyproxy/tinyproxy/commit/734ba1d9702cd7d420c624c3574bec1470ebf590 (1.11.0-rc1)

Search for package or bug name: Reporting problems