Summaryinfo

A vulnerability was found in tinyproxy up to 1.11.3. It has been declared as problematic. Impacted is the function strtol of the component Chunk Handler. The manipulation results in integer overflow. This vulnerability is known as CVE-2026-3945. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in tinyproxy up to 1.11.3. Affected is the function strtol of the component Chunk Handler. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on availability. CVE summarizes:

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol() without properly validating overflow conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt reading an extremely large amount of request-body data and holding worker connections open indefinitely. An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections from being accepted and causing complete service unavailability. Upstream addressed this issue in commit bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication.

The weakness was published by Muxammadiyev G'iyosiddin. The advisory is available at github.com. This vulnerability is traded as CVE-2026-3945 since 03/11/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 1.11.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-17066) and CERT Bund (WID-SEC-2026-0909). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Open Source Tinyproxy

Productinfo

Type

• Firewall Software

Name

• tinyproxy

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3

Website

• Product: https://github.com/tinyproxy/tinyproxy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion