CVE-2023-49606
high-risk
Published 2024-05-01
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.
Do I need to act?
!
74.2% chance of exploitation in next 30 days
EPSS score — higher than 26% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (2)
Tinyproxy
Tinyproxy
Affected Vendors
References (6)
58
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
19/34 · Moderate
Exposure
7/34 · Low