CVE-2026-3945

Name of the Vulnerable Software and Affected Versions tinyproxy versions prior to 1.11.3-2.1

Description An integer overflow exists in the HTTP chunked transfer encoding parser. The issue occurs because chunk size values are parsed using the strtol() function without properly validating overflow conditions, such as errno == ERANGE. A crafted chunk size, such as 0x7fffffffffffffff (LONG MAX), can bypass the chunklen < 0 validation check, leading to a signed integer overflow during the chunklen + 2 arithmetic operation. This results in incorrect size calculations, causing the proxy to attempt to read an excessively large amount of request-body data and keeping worker connections open indefinitely. An unauthenticated remote attacker can exploit this to exhaust all available worker slots, preventing new connections and causing a complete denial of service (DoS).

Recommendations Update to version 1.11.3-2.1.