CVE-2023-49606: tinyproxy project tinyproxy

csirt@kutim:~/threat-intel/cve/CVE-2023-49606

CVSS 9.8 · Critical EPSS 63,1%

Kerentanan Use After Free pada tinyproxy project tinyproxy. Skor CVSS 3.1 9.8 (Critical) menurut cisco.com.

Deskripsi (NVD)

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.

Rincian

Terbit di NVD: 1 Mei 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-416: Use After Free
EPSS (30 hari): 63,1% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tinyproxy project	tinyproxy	Versi 1.10.0
tinyproxy project	tinyproxy	Versi 1.11.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.openwall.com/lists/oss-security/2024/05/07/1 exploit · issue tracking · mailing list · patch
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889 exploit · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1889

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.