CVE-2026-55202highCWE-290

CVE-2026-55202: high-severity vulnerability in tinyproxy

Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

Published · Updated

Follow this CVE+ Monitor tinyproxy+ Monitor tinyproxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.4%
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
tinyproxy · tinyproxy
Related CVEs — tinyproxy

In the same product, most dangerous first.

CVE-2026-3945HIGHtinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of ServiceEPSS 0.6%CVE-2026-54388CRITICALTinyproxy - HTTP Request Smuggling via Duplicate Content-Length HeadersEPSS 0.4%CVE-2026-54387CRITICALTinyproxy - HTTP Request Smuggling via CL/TE DesynchronizationEPSS 0.4%CVE-2026-125371MEDIUMTinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix MatchEPSS —