This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-55202 →

DEBIAN-CVE-2026-55202

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated atta...

Original description

The description as published by the source.

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 tinyproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 tinyproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 tinyproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org