PT-2026-141194

CVE-2026-125371

·

Published

2026-11-09

·

Updated

2026-11-10

Description by

CVSS 3.1
4.8
Medium
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl string processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-187: Partial String Comparison
Related identifiers
CVE-2026-125371
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com