Tinyproxy Project maintains a lightweight HTTP proxy implementation widely embedded in embedded systems and resource-constrained environments, with its vulnerability profile concentrated in a single focused product. The recurring weakness classes—including improper privilege management, HTTP request smuggling, insecure defaults, integer overflow, and use-after-free conditions—reflect the parsing and access-control challenges inherent to a network-facing proxy handling untrusted client input. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tinyproxy Project over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-49606CRITICAL A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previous | May 1, 2024 | 9.8 | 68 | NO | NO |
CVE-2001-0129HIGH Buffer overflow in Tinyproxy HTTP proxy 1.3.3 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long connect request. | Mar 12, 2001 | 10.0 | 41 | NO | YES |
CVE-2026-54388CRITICAL Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to th | Jun 17, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-54387CRITICAL Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend whi | Jun 17, 2026 | 9.1 | 36 | NO | NO |
CVE-2026-55202HIGH Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page | Jun 17, 2026 | 8.2 | 33 | NO | NO |
CVE-2026-31842HIGH Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_tr | Apr 7, 2026 | 7.5 | 28 | NO | NO |
CVE-2022-40468HIGH Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buff | Sep 19, 2022 | 7.5 | 25 | NO | NO |
CVE-2025-63938MEDIUM Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. | Nov 26, 2025 | 6.5 | 23 | NO | NO |
CVE-2002-0847HIGH tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free). | Aug 12, 2002 | 7.5 | 20 | NO | NO |
CVE-2017-11747MEDIUM main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary p | Jul 30, 2017 | 5.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tinyproxy Project.
Media articles that mention a CVE ID that affects a product developed by Tinyproxy Project — matched by CVE ID, not by vendor name.