Every CVESearch/Get API key

CVE-2012-3505

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory...

5.0 MediumFix available

CVE-2012-3505 is a medium vulnerability (CVSS 5.0) in Banu Tinyproxy, published October 9, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.35%, the 94th percentile. Fixed in tinyproxy 1.8.3-3.

Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
7.35%EPSS, 94th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.8.3-3tinyproxy +6 more

Description

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket.

Exploit likelihood

7.35%Up 5.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tinyproxy
Debian:12
before 1.8.3-3
1.8.3-3
tinyproxy
Debian:13
before 1.8.3-3
1.8.3-3
tinyproxy
Debian:14
before 1.8.3-3
1.8.3-3
tinyproxy
Debian:6.0
before 1.8.2-1squeeze3, plus listed versions
1.8.2-11.8.2-1squeeze11.8.2-1squeeze2
1.8.2-1squeeze3
tinyproxy
SUSE:Package Hub 15 SP5
From an advisory covering 5 CVEs
before 1.11.2-bp155.3.3.1
1.11.2-bp155.3.3.1
tinyproxy
openSUSE:Leap 15.5
From an advisory covering 5 CVEs
before 1.11.2-bp155.3.3.1
1.11.2-bp155.3.3.1
tinyproxy
openSUSE:Tumbleweed
before 1.8.4-1.8
1.8.4-1.8

What each source reports

NVD Score used5.0

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket.

Record
CVE-2012-3505
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-310
Updated
2026-11-02
CVE ListNo score

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket.

Record
CVE-2012-3505
Updated
2026-11-02
EUVDEUVD-2012-3460No score

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket.

Record
EUVD-2012-3460
Updated
2026-11-03
GitHub AdvisoriesGHSA-h6wx-vrmp-rrjrNo score

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory...

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket.

Record
GHSA-h6wx-vrmp-rrjr
Updated
2026-11-02
OSVNo score

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket.

Record
CVE-2012-3505
Updated
2026-11-02
OSVDEBIAN-CVE-2012-3505No score

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket.

Record
DEBIAN-CVE-2012-3505
Updated
2026-11-02
OSVopenSUSE-SU-2024:0119-1No score

Security update for tinyproxy

This update for tinyproxy fixes the following issues:

  • Update to release 1.11.2

    • Fix potential use-after-free in header handling [CVE-2023-49606, boo#1223746]
    • Prevent junk from showing up in error page in invalid requests [CVE-2022-40468, CVE-2023-40533, boo#1223743]

  • Move tinyproxy program to /usr/bin.

  • Update to release 1.11.1

    • New fnmatch based filtertype

  • Update to release 1.11

    • Support for multiple bind directives.

  • update to 1.10.0:

    • Configuration file has moved from /etc/tinyproxy.conf to /etc/tinyproxy/tinyproxy.conf.
    • Add support for basic HTTP authentication
    • Add socks upstream support
    • Log to stdout if no logfile is specified
    • Activate reverse proxy by default
    • Support bind with transparent mode
    • Allow multiple listen statements in the configuration
    • Fix CVE-2017-11747: Create PID file before dropping privileges.
    • Fix CVE-2012-3505: algorithmic complexity DoS in hashmap
    • Bugfixes
    • BB#110: fix algorithmic complexity DoS in hashmap
    • BB#106: fix CONNECT requests with IPv6 literal addresses as host
    • BB#116: fix invalid free for GET requests to ipv6 literal address
    • BB#115: Drop supplementary groups
    • BB#109: Fix crash (infinite loop) when writing to log file fails
    • BB#74: Create log and pid files after we drop privs
    • BB#83: Use output of id instead of $USER
Record
openSUSE-SU-2024:0119-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10460-1No score

tinyproxy-1.8.4-1.8 on GA media

These are all security issues fixed in the tinyproxy-1.8.4-1.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10460-1
Updated
2026-11-02
OSVUBUNTU-CVE-2012-3505No score

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket.

Record
UBUNTU-CVE-2012-3505
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 18 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open