CVE-2023-49606

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.

• CWE-416

• http://www.openwall.com/lists/oss-security/2024/05/07/1Exploit, Issue Tracking, Mailing List, Patch, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889Exploit, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2024/05/07/1Exploit, Issue Tracking, Mailing List, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889Exploit, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1889

Published

May 1, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49599An insufficient entropy vulnerability exists in the salt gen…9.8
• CVE-2023-4960The WCFM Marketplace plugin for WordPress is vulnerable to S…5.4
• CVE-2023-49600An out-of-bounds write vulnerability exists in the PlyFile p…7.8
• CVE-2023-49602in OpenHarmony v3.2.4 and prior versions allow a local attac…5.5
• CVE-2023-49603Race condition in some Intel(R) System Security Report and S…8.7
• CVE-2023-49604Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-49607Mattermost fails to validate the type of the "reminder" body…7.5
• CVE-2023-49609Rejected reason: This is unused.
• CVE-2023-4961The Poptin plugin for WordPress is vulnerable to Stored Cros…5.4
• CVE-2023-49610 MachineSense FeverWarn Raspberry Pi-based devices…8.1
• CVE-2023-49611Rejected reason: This is unused.
• CVE-2023-49614Out of bounds write in firmware for some Intel(R) FPGA produ…5.7