CVE-2026-3945CWE-190

CVE-2026-3945

High · published March 30, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01036 · 63.6th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-03-30T12:16Z
References (5)
https://github.com/tinyproxy/tinyproxy/commit/969852c · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/tinyproxy/tinyproxy/commit/bb7edc4 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/tinyproxy/tinyproxy/issues/602 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/tinyproxy/tinyproxy/pull/603 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/tinyproxy/tinyproxy/releases · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 30 MAR 07:05Z
    An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote…
    cvelistv5