CVE-2026-109438 Details
Description
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.
A vulnerability allowing uninitialized stack memory disclosure has been identified in 3proxy versions 0.9.7 through 1.0.1. This issue, fixed in commit 206c923, arises when the external-NAT option is enabled. Under these conditions, unauthenticated attackers can leak stack bytes through the SOCKS4 reply path. By sending a client probe that bypasses the SOCKS version check, attackers can trigger a response containing uninitialized bytes from the sin structure. This response exposes high bytes of a userspace pointer, potentially weakening Address Space Layout Randomization (ASLR) protections.
Users can upgrade to 3proxy version 1.0.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 3proxy | >= 0.9.7, <= 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |