Tinyproxy CVE-2026-55202

Tinyproxy must be running a version up to and including 1.11.3 and reachable over the network from the attacker (the daemon's listening interface, default 8888, is exposed to attacker-controlled traffic). For statistics disclosure, the operator must have set the StatHost directive in tinyproxy.conf - without StatHost configured, the vulnerable code path is unreachable; the attacker then only needs to send a single HTTP request whose Host header equals the configured stathost value with a trailing ':<anyport>' or whose URL/Host parsing diverges. For the transparent-proxy misrouting variant, Tinyproxy must be deployed in transparent-proxy mode in front of an internal resource. No authentication, no user interaction, and no special client capabilities are required.

The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N is consistent with a fully remote, unauthenticated, low-complexity attack that primarily breaches confidentiality (statistics disclosure) with secondary integrity impact through transparent-proxy request misrouting; availability is unaffected, which matches the described behavior. No EPSS score, KEV listing, or SSVC decision was supplied, and no public exploit was identified at time of analysis, so this should be treated as a high-severity exposure rather than confirmed active exploitation. Mitigating real-world risk: stathost is only meaningful when the operator has configured StatHost in tinyproxy.conf, and impact is bounded by what that page reveals (connection counts, version, uptime) plus the ability to coerce transparent-proxy handling, which becomes serious mainly when Tinyproxy fronts an internal network and is used to enforce egress policy. The published upstream patch and the detailed pull-request diff materially raise exploitation likelihood over the medium term.

An attacker who can reach a Tinyproxy instance on the network sends an HTTP request whose Host header is set to the configured stathost value with an appended ':1234' port suffix (or otherwise crafted to defeat strcmp), causing Tinyproxy to serve the internal statistics page without authentication and disclose proxy version, connection counts, and client activity. The same Host/URL parsing mismatch can be abused in transparent-proxy mode to misroute a connection to an unintended upstream and bypass StatHost-based access controls. No weaponized public exploit was identified at time of analysis, but the upstream PR diff effectively describes the exact payload shape.