What’s Vulnerable › Vulnerabilities

CVE-2022-40468

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-19 · updated 2026-06-17
• Weakness: CWE-1188

Description

Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.

Affected products

• tinyproxy: through 1.11.1

References

• https://github.com/tinyproxy/tinyproxy
• https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346
• https://github.com/tinyproxy/tinyproxy/issues/457
• https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815
• https://security.gentoo.org/glsa/202305-27
• https://github.com/tinyproxy/tinyproxy
• https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346
• https://github.com/tinyproxy/tinyproxy/issues/457
• https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815
• https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html
• https://security.gentoo.org/glsa/202305-27

Get alerted when CVE-2022-40468 or the next vulnerability affects your stack