CVE-2026-3945: Tinyproxy

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).

Affected products

• Tinyproxy Tinyproxy: up to and including 1.11.3

Published 2026-03-30. Last modified 2026-08-10.