Uninitialized Stack Memory Disclosure in 3proxy by 3proxy Team
CVE-2026-109438

6.3MEDIUM

Key Information:

Vendor

3proxy

Status
3proxy
Vendor
CVE Published:
14 October 2026

What is CVE-2026-109438?

3proxy versions 0.9.7 to 1.0.1 are impacted by a vulnerability that allows unauthenticated attackers to exploit the SOCKS4 protocol. By sending a specially crafted client probe, attackers can trigger a response containing uninitialized bytes from the stack memory, which exposes sensitive information. This exposure may weaken Address Space Layout Randomization (ASLR) protections, making it easier for attackers to conduct further exploits. This issue has been addressed in a patch, but users of affected versions should update promptly to mitigate the risks associated with this vulnerability.

Affected Version(s)

3proxy 0.9.7 <= 1.0.1

3proxy 206c923d6cd433bd2e7196375442650c328b8bfa

References

https://github.com/3proxy/3proxy/commit/206c923d6cd433bd2...
patchissue-tracking
https://www.vulncheck.com/advisories/3proxy-uninitialized...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sam Barker of VulnCheck
.