Every CVE Search/ Get API key

CVE-2026-55202

Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

8.8 High

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.38%Unchanged since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Record
CVE-2026-55202
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-290
Updated
2026-11-02
EUVDEUVD-2026-37786 8.8

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Record
EUVD-2026-37786
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f33v-8wrm-6584 8.8

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header...

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Record
GHSA-f33v-8wrm-6584
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-290
Updated
2026-11-02
NVD 8.8

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Record
CVE-2026-55202
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-290
Updated
2026-11-02
OSV 8.8

Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Record
CVE-2026-55202
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-290
Updated
2026-11-02
OSVDEBIAN-CVE-2026-55202 8.8

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Record
DEBIAN-CVE-2026-55202
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55202 8.8

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Record
UBUNTU-CVE-2026-55202
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:11060-1 No score

tinyproxy-1.11.3-3.1 on GA media

These are all security issues fixed in the tinyproxy-1.11.3-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11060-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22133-1 No score

Security update for tinyproxy

This update for tinyproxy fixes the following issues:

Changes in tinyproxy:

  • Fixed failure to reconcile conflicting Content-Length and Transfer-Encoding [boo#1268474, CVE-2026-54387]
  • Fixed failure to reject requests containing multiple Content-Length headers with differing values [boo#1268475, CVE-2026-54388]
  • Fixed failure to properly validate the Host header during stathost detection [boo#1268476, CVE-2026-55202]
Record
openSUSE-SU-2026:22133-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tinyproxy
Debian:12
 All versions, plus listed versions
1.11.1-2.11.11.1-2.1+deb12u11.11.1-31.11.1-41.11.2-11.11.2-1~bpo12+11.11.3-11.11.3-1~bpo13+1
 None known
tinyproxy
Debian:13
 All versions, plus listed versions
1.11.2-11.11.3-11.11.3-1~bpo13+1
 None known
tinyproxy
Debian:14
 All versions, plus listed versions
1.11.2-11.11.3-11.11.3-1~bpo13+1
 None known
tinyproxy
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.8.3-3ubuntu11.8.3-3ubuntu14.04.1~esm11.8.3-3ubuntu14.04.1~esm21.8.3-3ubuntu14.04.1~esm3
 None known
tinyproxy
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.8.3-3ubuntu11.8.3-3ubuntu16.04.1~esm11.8.3-3ubuntu16.04.1~esm21.8.3-3ubuntu16.04.1~esm3
 None known
tinyproxy
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.8.4-21.8.4-31.8.4-51.8.4-5ubuntu0.1~esm11.8.4-5ubuntu0.1~esm21.8.4-5ubuntu0.1~esm3
 None known
tinyproxy
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.10.0-21.10.0-41.10.0-4ubuntu0.11.10.0-4ubuntu0.2
 None known
tinyproxy
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.10.0-51.11.0-11.11.0-1ubuntu0.1~esm11.11.0-1ubuntu0.1~esm2
 None known
tinyproxy
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.11.1-2.11.11.1-31.11.1-3ubuntu0.1
 None known
tinyproxy
Ubuntu:25.10
 All versions, plus listed versions
1.11.2-1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
tinyproxy
Ubuntu:26.10
 All versions, plus listed versions
1.11.3-1
 None known
tinyproxy
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.11.2-11.11.2-1build11.11.3-1
 None known
tinyproxy
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.11.3-3.1
1.11.3-3.1
tinyproxy
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 1.11.3-bp160.2.1
1.11.3-bp160.2.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55202 is a high vulnerability (CVSS 8.8) in Tinyproxy, published June 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. No source names a fixed version.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open