{"id":"CVE-2022-40468","aliases":["ALPINE-CVE-2022-40468","DEBIAN-CVE-2022-40468","DLA-3892-1","EUVD-2022-43746","GHSA-h3r7-x4mp-2c39","MGASA-2025-0003","UBUNTU-CVE-2022-40468","USN-7140-1","USN-7140-2","openSUSE-SU-2024:0119-1","openSUSE-SU-2024:12351-1"],"status":"published","title":"Tinyproxy commit 84f203f and earlier does not process HTTP request lines in the process_request()...","description":"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01897,"percentile":0.79784,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1188"],"published":"2022-09-19T00:00:00Z","modified":"2026-11-03T08:04:10Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tinyproxy","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tinyproxy","fixed_in":["1.11.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tinyproxy","fixed_in":["1.11.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tinyproxy","fixed_in":["1.11.1-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tinyproxy","fixed_in":["1.8.3-3ubuntu14.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tinyproxy","fixed_in":["1.8.3-3ubuntu16.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tinyproxy","fixed_in":["1.8.4-5ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tinyproxy","fixed_in":["1.10.0-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tinyproxy","fixed_in":["1.11.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tinyproxy","fixed_in":["1.11.1-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-5+deb11u1"}]}],"versions":["1.10.0-5"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-3ubuntu14.04.1~esm2"}]}],"versions":["1.8.3-3ubuntu1","1.8.3-3ubuntu14.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-3ubuntu16.04.1~esm2"}]}],"versions":["1.8.3-3ubuntu1","1.8.3-3ubuntu16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-5ubuntu0.1~esm2"}]}],"versions":["1.8.4-2","1.8.4-3","1.8.4-5","1.8.4-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-4ubuntu0.1"}]}],"versions":["1.10.0-2","1.10.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1ubuntu0.1~esm1"}]}],"versions":["1.10.0-5","1.11.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-3ubuntu16.04.1~esm2"}]}],"versions":["1.8.3-3ubuntu1","1.8.3-3ubuntu16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-5ubuntu0.1~esm2"}]}],"versions":["1.8.4-2","1.8.4-3","1.8.4-5","1.8.4-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-4ubuntu0.1"}]}],"versions":["1.10.0-2","1.10.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1ubuntu0.1~esm1"}]}],"versions":["1.10.0-5","1.11.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-3ubuntu14.04.1~esm2"}]}],"versions":["1.8.3-3ubuntu1","1.8.3-3ubuntu14.04.1~esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp155.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp155.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-2.1"}]}]}],"products":[{"vendor":"tinyproxy_project","product":"tinyproxy"}],"references":[{"url":"https://github.com/tinyproxy/tinyproxy","tags":["x_transferred","Third Party Advisory","package","report"]},{"url":"https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/tinyproxy/tinyproxy/issues/457","tags":["x_transferred","Exploit","Third Party Advisory","report"]},{"url":"https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815","tags":["x_transferred","report"]},{"url":"https://security.gentoo.org/glsa/202305-27","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40468","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h3r7-x4mp-2c39"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-40468","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40468.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-40468","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0003.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33206","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/05/07/1","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/","tags":["web"]},{"url":"https://lwn.net/Articles/990818/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7140-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7190-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-40468","tags":["report"]},{"url":"https://github.com/tinyproxy/tinyproxy/commit/3764b8551463b900b5b4e3ec0cd9bb9182191cb7","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40468","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7140-2","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200028","tags":["report"]},{"url":"https://bugzilla.suse.com/1203553","tags":["report"]},{"url":"https://bugzilla.suse.com/1223743","tags":["report"]},{"url":"https://bugzilla.suse.com/1223746","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49606","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-40468","description":"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.","status":"published","published":"2022-09-19T00:00:00Z","modified":"2025-11-04T16:09:53.843Z","updated_at":"2026-11-02T14:34:30.493103Z"}],"euvd":[{"id":"EUVD-2022-43746","description":"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.","status":"published","published":"2022-09-19T00:00:00Z","modified":"2025-11-04T16:09:53Z","updated_at":"2026-11-02T19:49:29.391161Z"}],"ghsa":[{"id":"GHSA-h3r7-x4mp-2c39","title":"Tinyproxy commit 84f203f and earlier does not process HTTP request lines in the process_request()...","description":"Tinyproxy commit 84f203f and earlier does not process HTTP request lines in the process_request() function and is using uninitialized buffers. This vulnerability allows attackers to access sensitive information at system runtime.","status":"published","published":"2022-09-20T00:00:29Z","modified":"2025-11-04T18:31:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:04:34.447716Z"}],"nvd":[{"id":"CVE-2022-40468","description":"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.","status":"published","published":"2022-09-19T17:15:14.7Z","modified":"2026-06-17T05:01:25.11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"ALPINE-CVE-2022-40468","description":"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.","status":"published","published":"2022-09-19T17:15:14.7Z","modified":"2026-11-03T07:18:33.691499561Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"DEBIAN-CVE-2022-40468","description":"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.","status":"published","published":"2022-09-19T17:15:14.7Z","modified":"2026-11-03T08:04:10.010755955Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"UBUNTU-CVE-2022-40468","description":"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.","status":"published","published":"2022-09-19T17:15:00Z","modified":"2026-02-04T04:24:02.920679Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"CVE-2022-40468","description":"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.","status":"published","published":"2022-09-19T00:00:00Z","modified":"2026-10-28T02:31:09.440904082Z","updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DLA-3892-1","title":"tinyproxy - security update","status":"published","published":"2024-09-18T00:00:00Z","modified":"2026-03-09T01:19:30.355946Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2025-0003","title":"Updated tinyproxy packages fix security vulnerabilities","description":"Potential leak of left-over heap data if custom error page templates\ncontaining special non-standard variables are used. Tinyproxy commit\n84f203f and earlier use uninitialized buffers in process_request()\nfunction.. (CVE-2022-40468)\nA use-after-free vulnerability exists in the HTTP Connection Headers\nparsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted\nHTTP header can trigger reuse of previously freed memory, which leads to\nmemory corruption and could lead to remote code execution. An attacker\nneeds to make an unauthenticated HTTP request to trigger this\nvulnerability. (CVE-2023-49606)\n","status":"published","published":"2025-01-10T19:54:34Z","modified":"2026-04-16T04:41:13.031237272Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0119-1","title":"Security update for tinyproxy","description":"This update for tinyproxy fixes the following issues:\n\n- Update to release 1.11.2\n  * Fix potential use-after-free in header handling [CVE-2023-49606, boo#1223746]\n  * Prevent junk from showing up in error page in invalid requests [CVE-2022-40468, CVE-2023-40533, boo#1223743]\n\n- Move tinyproxy program to /usr/bin.\n\n- Update to release 1.11.1\n  * New fnmatch based filtertype\n\n- Update to release 1.11\n  * Support for multiple bind directives.\n\n- update to 1.10.0:\n  * Configuration file has moved from /etc/tinyproxy.conf to\n    /etc/tinyproxy/tinyproxy.conf.\n  * Add support for basic HTTP authentication\n  * Add socks upstream support\n  * Log to stdout if no logfile is specified\n  * Activate reverse proxy by default\n  * Support bind with transparent mode\n  * Allow multiple listen statements in the configuration\n  * Fix CVE-2017-11747: Create PID file before dropping privileges.\n  * Fix CVE-2012-3505: algorithmic complexity DoS in hashmap\n  * Bugfixes\n  * BB#110: fix algorithmic complexity DoS in hashmap\n  * BB#106: fix CONNECT requests with IPv6 literal addresses as host\n  * BB#116: fix invalid free for GET requests to ipv6 literal address\n  * BB#115: Drop supplementary groups\n  * BB#109: Fix crash (infinite loop) when writing to log file fails\n  * BB#74: Create log and pid files after we drop privs\n  * BB#83: Use output of id instead of $USER\n","status":"published","published":"2024-05-10T12:42:27Z","modified":"2026-02-04T03:33:29.462336Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:12351-1","title":"tinyproxy-1.11.1-2.1 on GA media","description":"These are all security issues fixed in the tinyproxy-1.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:56:48.403223Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-7140-1","title":"tinyproxy vulnerability","description":"It was discovered that Tinyproxy did not properly manage memory under\ncertain circumstances. An attacker could possibly use this issue to leak\nleft-over heap data if custom error page templates containing special\nnon-standard variables are used.\n","status":"published","published":"2024-12-09T04:23:08Z","modified":"2026-06-25T13:32:29.850680876Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7140-2","title":"tinyproxy vulnerability","description":"USN-7140-1 fixed CVE-2022-40468 in tinyproxy. This update provides the\ncorresponding update for Ubuntu 14.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Tinyproxy did not properly manage memory under\n certain circumstances. An attacker could possibly use this issue to leak\n left-over heap data if custom error page templates containing special\n non-standard variables are used.\n","status":"published","published":"2025-01-06T08:56:31Z","modified":"2026-04-27T17:36:47.551745Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}