# CVE-2026-125371: Tinyproxy access control bypass in hostname matching

Source: https://junglewise.ai/threats/cve-2026-125371-tinyproxy-through-1-11-3-contains-an-access-control-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125371 · Severity: medium · CVSS 4.8 · Published 2026-11-10

Tinyproxy is a lightweight HTTP proxy daemon used to control network access. A flaw in its access control list (ACL) processing allows attackers who control a reverse DNS record (PTR record) for their IP address to bypass hostname-based access rules by registering a domain name that ends with an allowed domain. For example, an attacker controlling untrusted.net's PTR record could access a proxy restricted to trusted.net.

Technologies: [Tinyproxy](https://junglewise.ai/threats/technologies/tinyproxy). Vendors: [Tinyproxy](https://junglewise.ai/threats/vendors/tinyproxy).

## Quick answers

**Is CVE-2026-125371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125371 being exploited in the wild.

**How severe is CVE-2026-125371?** Medium severity, with a CVSS score of 4.8, published 10 November 2026.

**Which products and versions are affected?** Tinyproxy through 1.11.3.

**Is there a fix for CVE-2026-125371?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-125371 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125371?** Check whether you run Tinyproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The acl_string_processing() function in src/acl.c compares only the trailing characters of hostnames without respecting DNS label boundaries, performing a substring match rather than a full domain match. An attacker controlling their source IP's PTR record can register a hostname ending with an allowed domain (e.g., trusted.net) to satisfy an 'Allow trusted.net' ACL entry. The vulnerability requires no authentication or user interaction and can be exploited by any remote attacker who controls their reverse DNS.

## Affected products

- Tinyproxy Tinyproxy through 1.11.3

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/tinyproxy/tinyproxy](https://github.com/tinyproxy/tinyproxy)
- [https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c](https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c)

## Related threats

- [Tinyproxy authentication bypass in stathost detection](https://junglewise.ai/threats/cve-2026-55202-tinyproxy-authentication-bypass-in-stathost-detection)
- [Tinyproxy HTTP request smuggling via duplicate Content-Length headers](https://junglewise.ai/threats/cve-2026-54388-tinyproxy-http-request-smuggling-via-duplicate-content-length)
- [Tinyproxy HTTP request smuggling in request header parsing](https://junglewise.ai/threats/cve-2026-54387-tinyproxy-http-request-smuggling-in-request-header-parsing)
- [tinyproxy integer overflow in HTTP chunked transfer encoding](https://junglewise.ai/threats/cve-2026-3945-tinyproxy-integer-overflow-in-http-chunked-transfer-encoding)