CVE-2026-3945: tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3945?
CVE-2026-3945 is classified as a denial of service vulnerability due to an integer overflow in the HTTP chunked transfer encoding parser.
How do I fix CVE-2026-3945?
To fix CVE-2026-3945, upgrade TinyProxy to version 1.11.4 or later.
Who is affected by CVE-2026-3945?
CVE-2026-3945 affects all versions of TinyProxy up to and including version 1.11.3.
What type of attack can CVE-2026-3945 facilitate?
CVE-2026-3945 can facilitate a denial of service (DoS) attack by allowing attackers to exploit the integer overflow.
Is authentication required to exploit CVE-2026-3945?
No, CVE-2026-3945 can be exploited by unauthenticated remote attackers.