CVE-2026-3945 tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service
An unauthenticated remote attacker can cause a denial of service in tinyproxy via an integer overflow in the HTTP chunked transfer encoding parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3945?
CVE-2026-3945 is a high-severity vulnerability in tinyproxy, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
Weakness: CWE-190
Which versions are affected by CVE-2026-3945?
Linux distribution packages (2)
tinyproxy openSUSE:Leap 16.0 | All versions | 1.11.3-bp160.1.1 |
tinyproxy openSUSE:Tumbleweed | All versions | 1.11.3-2.1 |
How do I fix CVE-2026-3945?
Apply the vendor's patch.
Is CVE-2026-3945 being exploited?
There is no known exploitation of CVE-2026-3945 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-3945, GHSA-6vhj-8f7g-v7f7, UBUNTU-CVE-2026-3945, openSUSE-SU-2026:10471-1, openSUSE-SU-2026:20456-1.