CVE-2023-49606

CRITICAL EXPLOITED

tinyproxy 1.10.0 and 1.11.1 - Unauthenticated Use-After-Free in HTTP Connection Headers Parsing

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-49606 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including d0rb.

AI-analyzed exploit summary The repository contains a functional exploit PoC for CVE-2023-49606, demonstrating a use-after-free vulnerability in Tinyproxy. The exploit triggers memory corruption by adding a large number of headers and then crafting a payload to execute a reverse shell.

Description

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.

Exploits (1)

nomisec WORKING POC 4 stars
by d0rb · poc
https://github.com/d0rb/CVE-2023-49606

The repository contains a functional exploit PoC for CVE-2023-49606, demonstrating a use-after-free vulnerability in Tinyproxy. The exploit triggers memory corruption by adding a large number of headers and then crafting a payload to execute a reverse shell.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Tinyproxy 1.11.1, 1.10.0
No auth needed
Prerequisites: Network access to Tinyproxy server · Ability to send crafted HTTP requests
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.6308
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2026-04-06
CWE
CWE-416
Status published
Products (2)
tinyproxy_project/tinyproxy 1.10.0
tinyproxy_project/tinyproxy 1.11.1
Published May 01, 2024
Tracked Since Feb 18, 2026