new file mode 100644
@@ -0,0 +1,70 @@
+From 8c8463fb1a0bf7db82d3dfc6f363d5b339e96cd3 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Tue, 15 Sep 2026 06:42:05 +0000
+Subject: [PATCH] acl: use hostspec parser to disallow suffix hostname matches
+
+the existing ad-hoc parsing in acl.c allowed an attacker to
+use e.g. an "untrusted.net" domain name to access a reachable
+tinyproxy instance if it had an allow list entry for "trusted.net".
+
+exploiting it would require that the attacker has prior knowledge
+of the instance's configuration or is damn good at guessing and
+well-budgeted to register lots of potentially matching domains.
+
+fix by re-using the existing hardened hostspec parser.
+
+closes #627
+
+(cherry picked from commit 3991ac8f98c6a9f05b3265018b812dbf2ca92c28)
+CVE: CVE-2026-125371
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/acl.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/src/acl.c b/src/acl.c
+index 2d141ba..db526db 100644
+--- a/src/acl.c
++++ b/src/acl.c
+@@ -105,7 +105,6 @@ acl_string_processing (struct acl_s *acl, const char *ip_address,
+ {
+ int match;
+ struct addrinfo hints, *res, *ressave;
+- size_t test_length, match_length;
+ char ipbuf[512];
+
+ assert (acl && acl->h.type == HST_STRING);
+@@ -153,23 +152,17 @@ STRING_TEST:
+ return -1;
+ }
+
+- test_length = strlen (string_addr);
+- match_length = strlen (acl->h.address.string);
+-
+ /*
+- * If the string length is shorter than AC string, return a -1 so
+- * that the "driver" will skip onto the next control in the list.
++ * compare the reverse-resolved client hostname against the ACL
++ * entry, using the shared hostspec matcher so that hostname
++ * entries are matched at label boundaries: plain entries match
++ * the whole hostname exactly, and leading-dot entries match the
++ * apex host plus every subdomain below it. This prevents
++ * suffix-collision bypasses, e.g. "Allow trusted.net" must not
++ * admit "untrusted.net" (GH issue #627).
+ */
+- if (test_length < match_length)
+- return -1;
+-
+- if (strcasecmp
+- (string_addr + (test_length - match_length),
+- acl->h.address.string) == 0) {
+- if (acl->access == ACL_DENY)
+- return 0;
+- else
+- return 1;
++ if (hostspec_match (string_addr, &acl->h) != 0) {
++ return acl->access != ACL_DENY;
+ }
+
+ /* Indicate that no tests succeeded, so skip to next control. */
@@ -13,6 +13,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
file://CVE-2026-54387.patch \
file://CVE-2026-55202.patch \
file://CVE-2026-54388.patch \
+ file://CVE-2026-125371.patch \
"
SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"