CVE-2026-125371
Received Received - Intake

Access Control Bypass in Tinyproxy via PTR Record Spoofing

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125371
EUVD
EUVD-2026-120534

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tinyproxy tinyproxy to 1.11.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-187 The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Tinyproxy through version 1.11.3 has an access control bypass flaw in the acl_string_processing() function. The vulnerability occurs because the function only checks trailing characters of a hostname in PTR records without verifying DNS label boundaries. This allows attackers who control their source IP's PTR record to bypass deny-by-default access control lists (ACLs) by matching an allowed domain suffix.

Detection Guidance

To detect this vulnerability, inspect Tinyproxy ACL configurations for improper hostname suffix matches. Check if rules like 'Allow trusted.net' exist and verify if hostnames ending in 'trusted.net' (e.g., 'untrusted.net') are unintentionally allowed. Review reverse DNS PTR records for suspicious hostnames that could exploit suffix collisions.

Impact Analysis

If you use Tinyproxy with ACLs to restrict access, attackers could exploit this to bypass your intended restrictions. For example, if your ACL allows 'trusted.net', an attacker controlling 'untrusted.net' could manipulate their PTR record to match and gain unauthorized proxy access. This could lead to misuse of your proxy server for malicious activities.

Compliance Impact

This vulnerability could undermine compliance with data protection regulations like GDPR and HIPAA by allowing unauthorized access to proxy services. If an organization uses Tinyproxy with ACL rules to restrict access to sensitive data or systems, attackers could bypass these controls by manipulating PTR records to match allowed domains. This could lead to unauthorized data exfiltration or access to protected resources, violating confidentiality and access control requirements.

Mitigation Strategies

Upgrade Tinyproxy to version 1.11.4 or later to address the ACL bypass vulnerability. Review and update ACL configurations to ensure proper hostname matching and avoid relying on partial PTR record matches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...