CVE-2022-40468

Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.

• CWE-1188

• https://github.com/tinyproxy/tinyproxyThird Party Advisory
• https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346Exploit, Third Party Advisory
• https://github.com/tinyproxy/tinyproxy/issues/457Exploit, Third Party Advisory
• https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815
• https://security.gentoo.org/glsa/202305-27
• https://github.com/tinyproxy/tinyproxyThird Party Advisory
• https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346Exploit, Third Party Advisory
• https://github.com/tinyproxy/tinyproxy/issues/457Exploit, Third Party Advisory
• https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815
• https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html
• https://security.gentoo.org/glsa/202305-27

Published

Sep 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40443An absolute path traversal vulnerability in ZZCMS 2022 allow…5.3
• CVE-2022-40444ZZCMS 2022 was discovered to contain a full path disclosure …5.3
• CVE-2022-40446ZZCMS 2022 was discovered to contain a SQL injection vulnera…7.2
• CVE-2022-40447ZZCMS 2022 was discovered to contain a SQL injection vulnera…7.2
• CVE-2022-4045A denial-of-service vulnerability in the Mattermost allows a…6.5
• CVE-2022-4046In CODESYS Control in multiple versions a improper restricti…8.8
• CVE-2022-40469iKuai OS v3.6.7 was discovered to contain an authenticated r…8.8
• CVE-2022-4047The Return Refund and Exchange For WooCommerce WordPress plu…9.8
• CVE-2022-40470Phpgurukul Blood Donor Management System 1.0 allows Cross Si…4.8
• CVE-2022-40471Remote Code Execution in Clinic's Patient Management System …9.8
• CVE-2022-40472ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build:…8
• CVE-2022-40475TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to con…9.8