Tinyproxy versions through 1.11.3 contain a flaw in the hostname access control logic, where the ACL routine incorrectly compares only the trailing characters of a hostname without respecting DNS label boundaries. This allows an attacker who can influence the PTR record of the source IP to craft a hostname that ends with an approved suffix, thereby satisfying an 'Allow trusted.net' entry even when the proxy is configured with a deny‑by‑default policy. The consequence is that unauthenticated clients can gain proxy access, potentially leaking traffic or bypassing network restrictions.

The vulnerable implementation is distributed in the open‑source Tinyproxy project. All releases up to and including 1.11.3 are affected. The problem exists in the acl.c source file for those versions. Administrators running Tinyproxy 1.11.3 or older should be aware that no single‑package fix exists beyond the upstream patch returned in later releases.

The vulnerability carries a CVSS score of 6.3, indicating a moderate risk level. No EPSS data is available and the issue is not listed in CISA’s KEV catalog, suggesting lower exploitation likelihood but still possible. An attacker can exploit it remotely by controlling the reverse DNS of the source IP, which is a realistic vector in many environments. The lack of pre‑existing mitigation means administrators should treat this as a medium‑severity privilege escalation risk.