Vulnerabilities

TI-2026-71023 CVE-2026-108899 · GHSA-6qcv-qc7g-33wv

Improper authorization in tobychui Zoraxy Path Exception Matcher

HIGH 70

A flaw has been found in tobychui zoraxy up to 3.3.4.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00454 Published 2026-10-12 Fixed in 3.3.5-rc1 CWE-266

TI-2026-64663 CVE-2026-100390 · GHSA-7crf-73jx-vf27

MEDIUM 41

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0029 Published 2026-09-25 No fix listed CWE-290

TI-2024-34897 CVE-2024-52010 · GHSA-7hpf-g48v-hw3j

MEDIUM 40

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01503 Published 2024-11-12 Fixed in 3.1.3 CWE-78