Integer Overflow Vulnerability in Tinyproxy Affects Remote Access

CVE-2026-3945

What is CVE-2026-3945?

An integer overflow vulnerability in the HTTP chunked transfer encoding parser of Tinyproxy versions up to and including 1.11.3 allows unauthenticated remote attackers to exploit the system, causing denial of service (DoS). The vulnerability arises from improper validation when parsing chunk size values, particularly those that exceed the maximum limit (LONG_MAX). This leads to incorrect arithmetic operations, which can exhaust worker slots by causing the application to attempt to read excessive amounts of data. Consequently, this results in an inability to accept new connections, leaving the service unavailable for legitimate users.

References