CVE-2026-3945
Publication date 30 March 2026
Last updated 13 August 2026
Ubuntu priority
Description
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| tinyproxy | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial | Ignored end of ESM support, was needs-triage | |
| 14.04 LTS trusty |
Needs evaluation
|
Severity score breakdown
CVSS version:
Base score
8.7 · High
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-3945
- https://github.com/tinyproxy/tinyproxy/issues/602
- https://github.com/tinyproxy/tinyproxy/pull/603
- https://github.com/tinyproxy/tinyproxy/commit/969852c
- https://github.com/tinyproxy/tinyproxy/commit/bb7edc4
- https://github.com/tinyproxy/tinyproxy/releases