VULNERABILITY INTELLIGENCE
CVE-2026-3945
CVSS score7.5 HIGH
EPSS probability0.60%
CISA KEVNot currently listed
Published2026-03-30
Last modified2026-08-10
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
Weakness classification
- 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c: CWE-190