← back
CVE-2026-3945highCWE-190

tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.6%
exploitation probability
0.6%top 55% of all CVEs
observed exploitation
nono source reports it
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
tinyproxy · tinyproxy