CVE-2026-125371
Description
A flaw was found in Tinyproxy. The proxy server improperly validates client hostnames against access control lists (ACLs) by matching trailing characters without verifying Domain Name System (DNS) label boundaries. A remote attacker who controls reverse DNS pointer (PTR) records for their IP address can craft a hostname that matches the end of an allowed domain, bypassing access restrictions to unauthorizedly route traffic through the proxy.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires specific non-default access control configurations using domain names rather than IP addresses, along with control over external reverse DNS records. When Tinyproxy is deployed to restrict proxy clients using hostname-based allow lists, an attacker capable of manipulating PTR records for their originating address can bypass filtering to route requests through the proxy. The flaw does not allow remote code execution or direct compromise of the host system, and deployments enforcing ACLs strictly via IP addresses or subnets are unaffected.
Mitigation
To mitigate this flaw, configure Tinyproxy to enforce access controls strictly using IP addresses or CIDR subnets rather than hostnames or domain names.
1. Edit `/etc/tinyproxy/tinyproxy.conf` to replace any domain-based `Allow` or `Deny` directives with explicit IP addresses or subnets:
# Avoid hostname entries such as 'Allow example.com'
Allow 192.168.1.0/24
Allow 10.0.0.0/8
2. Additionally, restrict access to the Tinyproxy listening port (default 8888/tcp) at the firewall level using firewalld to ensure only authorized subnets can reach the service:
firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24
firewall-cmd --reload
3. Apply configuration changes by restarting the service:
systemctl restart tinyproxy
Warning: Restarting or reloading the Tinyproxy service will terminate active client connections. Relying solely on IP-based ACLs requires administrative overhead to maintain accurate client IP allocations.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
This can lead to incorrect results and resultant weaknesses. For example, the code might inadvertently compare references to objects, instead of the relevant contents of those objects, causing two "equal" objects to be considered unequal.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
