CVE-2026-109438: 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
3proxyto a version that resolves this vulnerability.Patch 206c923
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments are 3proxy versions 0.9.7 through 1.0.1 that have the external-NAT option (-Ne) configured and expose the SOCKS4 reply path to attackers.
What does an attacker need to exploit it?
No authentication, privileges, or user interaction are required. An attacker can send a client probe that fails the SOCKS version check, causing a reply that includes uninitialized bytes from the sin structure.
What is disclosed if exploitation succeeds?
The disclosure can expose high bytes of a userspace pointer from stack memory. This weakens ASLR protections; the provided data does not indicate direct integrity or availability impact.
How can the issue be remediated?
Update to a version containing the fix in commit 206c923. If updating cannot happen immediately, removing the external-NAT (-Ne) configuration prevents the described vulnerable condition.