CVE-2026-3945 — tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause…
Published: 2026-03-30 · CVSS: 8.7 · CVSS 4.0
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7