An unauthenticated remote attacker can supply crafted HTTP headers to trigger this memory corruption. Successful exploitation leads to a crash of the proxy process, resulting in a denial of service (DoS). Furthermore, due to the nature of use-after-free vulnerabilities in memory-unsafe environments, there is a potential for remote code execution (RCE) if an attacker can precisely manipulate the heap state. A proof-of-concept exploit script has been publicly disclosed on Sploitus, increasing the risk of exploitation for unpatched internet-facing proxy instances.

Impact

The vulnerability carries a CVSS score of 9.8, indicating high severity across confidentiality, integrity, and availability. Successful exploitation typically results in immediate service disruption (DoS). In environments where Tinyproxy is used as a gateway or intermediate proxy, potential RCE could grant attackers unauthorized access to the underlying server, facilitating lateral movement or further network compromise.

Recommendation

• Immediately audit network infrastructure to identify all instances of Tinyproxy 1.10.0 and 1.11.1.
• Patch or upgrade affected Tinyproxy instances to the latest available stable release that addresses CVE-2023-49606.
• Implement ingress filtering on the proxy to block abnormally large or malformed HTTP header sequences if immediate patching is not feasible.
• Monitor webserver and proxy error logs for frequent segmentation faults or abnormal process terminations associated with the Tinyproxy service.