diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch
new file mode 100644
index 0000000000..7a86af207c
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch
@@ -0,0 +1,70 @@
+From 8c8463fb1a0bf7db82d3dfc6f363d5b339e96cd3 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Tue, 15 Sep 2026 06:42:05 +0000
+Subject: [PATCH] acl: use hostspec parser to disallow suffix hostname matches
+
+the existing ad-hoc parsing in acl.c allowed an attacker to
+use e.g. an "untrusted.net" domain name to access a reachable
+tinyproxy instance if it had an allow list entry for "trusted.net".
+
+exploiting it would require that the attacker has prior knowledge
+of the instance's configuration or is damn good at guessing and
+well-budgeted to register lots of potentially matching domains.
+
+fix by re-using the existing hardened hostspec parser.
+
+closes #627
+
+(cherry picked from commit 3991ac8f98c6a9f05b3265018b812dbf2ca92c28)
+CVE: CVE-2026-125371
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/acl.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/src/acl.c b/src/acl.c
+index 2d141ba..db526db 100644
+--- a/src/acl.c
++++ b/src/acl.c
+@@ -105,7 +105,6 @@ acl_string_processing (struct acl_s *acl, const char *ip_address,
+ {
+         int match;
+         struct addrinfo hints, *res, *ressave;
+-        size_t test_length, match_length;
+         char ipbuf[512];
+ 
+         assert (acl && acl->h.type == HST_STRING);
+@@ -153,23 +152,17 @@ STRING_TEST:
+                         return -1;
+         }
+ 
+-        test_length = strlen (string_addr);
+-        match_length = strlen (acl->h.address.string);
+-
+         /*
+-         * If the string length is shorter than AC string, return a -1 so
+-         * that the "driver" will skip onto the next control in the list.
++         * compare the reverse-resolved client hostname against the ACL
++         * entry, using the shared hostspec matcher so that hostname
++         * entries are matched at label boundaries: plain entries match
++         * the whole hostname exactly, and leading-dot entries match the
++         * apex host plus every subdomain below it. This prevents
++         * suffix-collision bypasses, e.g. "Allow trusted.net" must not
++         * admit "untrusted.net" (GH issue #627).
+          */
+-        if (test_length < match_length)
+-                return -1;
+-
+-        if (strcasecmp
+-            (string_addr + (test_length - match_length),
+-             acl->h.address.string) == 0) {
+-                if (acl->access == ACL_DENY)
+-                        return 0;
+-                else
+-                        return 1;
++        if (hostspec_match (string_addr, &acl->h) != 0) {
++                return acl->access != ACL_DENY;
+         }
+ 
+         /* Indicate that no tests succeeded, so skip to next control. */
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
index 46d3a4d7c6..86e7e906b1 100644
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
@@ -13,6 +13,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
            file://CVE-2026-54387.patch \
            file://CVE-2026-55202.patch \
            file://CVE-2026-54388.patch \
+           file://CVE-2026-125371.patch \
            "
 
 SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"