CVE-2023-49606criticalobserved exploitationCWE-416

CVE-2023-49606: critical vulnerability in Tinyproxy

Published · Updated

Follow this CVE+ Monitor tinyproxy+ Monitor tinyproxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.8epss 63%
from disclosure to weapon6 days
Published on NVDMay 1
1st PoC+6d
VulnCheck+705d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Tinyproxy · Tinyproxy
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.