CVE-2026-3945 Details
Description
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
A denial-of-service vulnerability has been identified in Tinyproxy versions through 1.11.3. The issue arises from an integer overflow in the HTTP chunked transfer encoding parser, located in 'src/reqs.c'. This vulnerability allows an unauthenticated remote attacker to cause service disruption by sending crafted chunk sizes that bypass existing validation checks. The improper handling of large chunk sizes leads to signed integer overflows during size calculations, causing the proxy to read excessive amounts of request-body data. This behavior exhausts available worker connections, holding them open indefinitely and preventing new connections, thereby causing complete service unavailability.
Users can upgrade to Tinyproxy version 1.11.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinyproxy/tinyproxy/commit/969852c | TuranSec | |
| https://github.com/tinyproxy/tinyproxy/commit/bb7edc4 | TuranSec | |
| https://github.com/tinyproxy/tinyproxy/issues/602 | TuranSec | |
| https://github.com/tinyproxy/tinyproxy/pull/603 | TuranSec | |
| https://github.com/tinyproxy/tinyproxy/releases | TuranSec |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | TuranSec |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Jun 17, 2026 | CVE Modified | TuranSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | New CVE Received | TuranSec |