EUVD-2026-120534

Tinyproxy through 1.11.3 contains an access control bypass vulnerability in aclstringprocessing in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allo...

CVE-2026-125371

Tinyproxy versions through 1.11.3 are vulnerable to an access control bypass within the acl_string_processing() function in src/acl.c. The root cause is that the software compares only the trailing characters of a hostname without verifying DNS label boundaries . This allows an attacker who contr...