Tinyproxy
Vendor:
First CVE: Mar 12, 2001 · Active for 25 years
10
Total CVEs
More Total CVEs than 77% of tracked products
1.4
Avg CVEs / Year
Bottom 1%
8.1
Avg CVSS
Higher Avg CVSS than 48% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Tinyproxy over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 12, 2001
25 years ago
Most Recent CVE
Jun 17, 2026
37 days ago
CVE Severity & Scoring
Tinyproxy10 CVEs
20%
50%
30%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (10.0%)
Network7 (70.0%)
Unknown2 (20.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (80.0%)
High0 (0.0%)
Unknown2 (20.0%)
User Interaction
None8 (80.0%)
Unknown2 (20.0%)
Required0 (0.0%)
Privileges Required
Low1 (10.0%)
High0 (0.0%)
None7 (70.0%)
Unknown2 (20.0%)
Top CVEs
Signals from CVEs in this product scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-49606CRITICAL A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previous | May 1, 2024 | 9.8 | 68 | NO | NO |
CVE-2001-0129HIGH Buffer overflow in Tinyproxy HTTP proxy 1.3.3 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long connect request. | Mar 12, 2001 | 10.0 | 41 | NO | YES |
CVE-2026-54388CRITICAL Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to th | Jun 17, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-54387CRITICAL Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend whi | Jun 17, 2026 | 9.1 | 36 | NO | NO |
CVE-2026-55202HIGH Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page | Jun 17, 2026 | 8.2 | 33 | NO | NO |
CVE-2026-31842HIGH Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_tr | Apr 7, 2026 | 7.5 | 28 | NO | NO |
CVE-2022-40468HIGH Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buff | Sep 19, 2022 | 7.5 | 25 | NO | NO |
CVE-2025-63938MEDIUM Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. | Nov 26, 2025 | 6.5 | 23 | NO | NO |
CVE-2002-0847HIGH tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free). | Aug 12, 2002 | 7.5 | 20 | NO | NO |
CVE-2017-11747MEDIUM main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary p | Jul 30, 2017 | 5.5 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (10 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
10.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (10 CVEs).
Media Mentions
Signals from CVEs in this product scope (10 CVEs).
Top CNAs Publishing CVEs For Tinyproxy
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.4.3 | 1 | 7.5 | 2.8% | 0 | 0 |
| 1.3.3 | 2 | 8.8 | 8.4% | 0 | 1 |
| 1.3.2 | 1 | 7.5 | 2.8% | 0 | 0 |
| 1.11.1 | 1 | 9.8 | 63.1% | 0 | 0 |
| 1.10.0 | 1 | 9.8 | 63.1% | 0 | 0 |