new file mode 100644
@@ -0,0 +1,107 @@
+From 04b34f814076d790db26925d7df7c30798910c99 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Sat, 18 Apr 2026 00:03:15 +0200
+Subject: [PATCH] reqs: improve stathost detection (#606)
+
+until now, only the basicauth code checked the host header, regular connections didn't.
+
+- add a new helper function to compare a hostname with optional
+ trailingcolon/port against the stathost.
+- add stathost check via host header before transparent proxy check,
+ else stathost might be misdetected as a trans host request.
+- refactor existing stathost checks to use the new helper
+
+this should make it easier to access the stathost, for example by
+injecting a host header into a curl command line with -H:
+
+ $ curl -H "Host: tinyproxy.stats" 127.0.0.1:8080
+
+the stathost can also be specified as an ip address, e.g.
+Stathost "127.0.0.10" + a separate Listen statement for that ip.
+in such a case e.g.
+
+ $ curl http://127.0.0.10:8080
+
+would work too, even if curl didn't add a Host header (but it does anyway).
+
+(cherry picked from commit 09312a185ae25cc486b4ff5987638a7917a48bce)
+
+CVE: CVE-2026-55202
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/reqs.c | 37 +++++++++++++++++++++++++------------
+ 1 file changed, 25 insertions(+), 12 deletions(-)
+
+diff --git a/src/reqs.c b/src/reqs.c
+index e3cfe76..d5037cf 100644
+--- a/src/reqs.c
++++ b/src/reqs.c
+@@ -316,6 +316,17 @@ static int send_connect_method_response (struct conn_s *connptr)
+ connptr->protocol.minor);
+ }
+
++/* determine whether a hostname with optional trailing colon/port is the
++ stathost */
++static int is_stathost (const char* host)
++{
++ const char *p = config->stathost;
++ const char *q = host;
++ if (!p || !q) return 0;
++ while (*p && *(p++) == *(q++));
++ return *p == 0 && (*q == 0 || *q == ':');
++}
++
+ /*
+ * Break the request line apart and figure out where to connect and
+ * build a new request line. Finally connect to the remote server.
+@@ -384,6 +395,16 @@ BAD_REQUEST_ERROR:
+ goto fail;
+ }
+
++ /*
++ * Check to see if they're requesting the stat host
++ */
++ if (is_stathost (pseudomap_find (hashofheaders, "host"))) {
++got_stathost:
++ log_message (LOG_NOTICE, "Request for the stathost.");
++ connptr->show_stats = TRUE;
++ goto fail;
++ }
++
+ #ifdef REVERSE_SUPPORT
+ if (config->reversepath_list != NULL) {
+ /*
+@@ -497,19 +518,11 @@ BAD_REQUEST_ERROR:
+ }
+ }
+ #endif
+-
+-
+- /*
+- * Check to see if they're requesting the stat host
+- */
+- if (config->stathost && strcmp (config->stathost, request->host) == 0) {
+- log_message (LOG_NOTICE, "Request for the stathost.");
+- connptr->show_stats = TRUE;
+- goto fail;
+- }
++ /* check whether hostname from url is the stathost */
++ if (is_stathost (request->host))
++ goto got_stathost;
+
+ safefree (url);
+-
+ return request;
+
+ fail:
+@@ -1688,7 +1701,7 @@ void handle_connection (struct conn_s *connptr, union sockaddr_union* addr)
+
+ if (!authstring && config->stathost) {
+ authstring = pseudomap_find (hashofheaders, "host");
+- if (authstring && !strncmp(authstring, config->stathost, strlen(config->stathost))) {
++ if (authstring && is_stathost(authstring)) {
+ authstring = pseudomap_find (hashofheaders, "authorization");
+ stathost_connect = 1;
+ } else authstring = 0;
@@ -11,6 +11,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
file://CVE-2026-3945-2.patch \
file://CVE-2026-31842.patch \
file://CVE-2026-54387.patch \
+ file://CVE-2026-55202.patch \
"
SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"