Vulnerability Description
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/tinyproxy/tinyproxy/commit/969852c
- https://github.com/tinyproxy/tinyproxy/commit/bb7edc4
- https://github.com/tinyproxy/tinyproxy/issues/602
- https://github.com/tinyproxy/tinyproxy/pull/603
- https://github.com/tinyproxy/tinyproxy/releases
FAQ
What is CVE-2026-3945?
CVE-2026-3945 is a vulnerability with a CVSS score of 7.5 (HIGH). An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (D...
How severe is CVE-2026-3945?
CVE-2026-3945 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-3945?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.