CVE-2026-3945
tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service
Published Mar 30, 2026
CVSS 4.0 · 8.7 High
EPSS < 1%
KEV · Not listed
Description
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| tinyproxy | tinyproxy | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Tinyproxy | Tinyproxy |
|
Remediation
Tracking
Advisories
Metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
Attack Requirements None
User Interaction None
Vulnerable System Confidentiality Impact None
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact High
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.601% probability within 30 days)
Exploitation none
Automatable yes
Technical Impact partial
References
History
Aug 10, 2026 12:00 PM
Description updated. Title updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol() without properly validating overflow conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt reading an extremely large amount of request-body data and holding worker connections open indefinitely. An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections from being accepted and causing complete service unavailability. Upstream addressed this issue in commit bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication. | An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE). |
| Title | tinyproxy - Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service | tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service |
Aug 10, 2026 11:45 AM
Title updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service | tinyproxy - Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service |
Aug 5, 2026 1:45 PM
Title updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Integer Overflow in Tinyproxy Chunked Transfer Parsing Causes DoS | tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service |
Apr 1, 2026 2:15 AM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Tinyproxy
Tinyproxy tinyproxy |
|
| Vendors & Products |
Tinyproxy
Tinyproxy tinyproxy |
Mar 31, 2026 3:00 AM
Title updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Integer Overflow in Tinyproxy Chunked Transfer Parsing Causes DoS |
Mar 30, 2026 3:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mar 30, 2026 7:30 AM
Description updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol() without properly validating overflow conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt reading an extremely large amount of request-body data and holding worker connections open indefinitely. An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections from being accepted and causing complete service unavailability. Upstream addressed this issue in commit bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication. | |
| Weaknesses | CWE-190 | |
| References |
| |
| Metrics |
cvssV2_0
|
Weaknesses
