TI-2023-27093 CVE-2023-49606 · GHSA-w78j-vw2g-233v
Use after free in Tinyproxy
Priority HIGH 84
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0.
Tinyproxy Project
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Tinyproxy Project records in CISA KEVNo Tinyproxy Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2026-24395 CVE-2026-31842 · GHSA-mh87-c4c3-cgwf
Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling
Priority HIGH 77
Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c.
TI-2022-19200 CVE-2022-40468 · GHSA-h3r7-x4mp-2c39
Potential leak of left-over heap data if custom error page templates containing special…
Priority LOW 37
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used.
TI-2025-39495 CVE-2025-63938 · GHSA-w547-jc37-w3cr
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the…
Priority LOW 35
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.
TI-2017-08702 CVE-2017-11747 · GHSA-r3gc-6285-7fj7
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after…
Priority LOW 25
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this no…