CVE-2026-3945

{"id": "CVE-2026-3945", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3945", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T15:01:46.663274Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "tinyproxy", "product": "tinyproxy", "versions": [{"status": "affected", "version": "<=1.11.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-30T08:16:17.653", "references": [{"url": "https://github.com/tinyproxy/tinyproxy/commit/969852c", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/tinyproxy/tinyproxy/commit/bb7edc4", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/tinyproxy/tinyproxy/issues/602", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/tinyproxy/tinyproxy/pull/603", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/tinyproxy/tinyproxy/releases", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol() without properly validating overflow conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt reading an extremely large amount of request-body data and holding worker connections open indefinitely. An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections from being accepted and causing complete service unavailability. Upstream addressed this issue in commit bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de entero en el analizador de codificaci\u00f3n de transferencia fragmentada HTTP en tinyproxy hasta la versi\u00f3n 1.11.3 inclusive permite a un atacante remoto no autenticado causar una denegaci\u00f3n de servicio (DoS). El problema ocurre porque los valores de tama\u00f1o de fragmento se analizan usando strtol() sin validar adecuadamente las condiciones de desbordamiento (p. ej., errno == ERANGE). Un tama\u00f1o de fragmento manipulado como 0x7fffffffffffffff (LONG_MAX) omite la comprobaci\u00f3n de validaci\u00f3n existente (chunklen &lt; 0), lo que lleva a un desbordamiento de entero con signo durante las operaciones aritm\u00e9ticas (chunklen + 2). Esto resulta en c\u00e1lculos de tama\u00f1o incorrectos, lo que hace que el proxy intente leer una cantidad extremadamente grande de datos del cuerpo de la solicitud y manteniendo las conexiones de los trabajadores abiertas indefinidamente. Un atacante puede explotar este comportamiento para agotar todos los espacios de trabajador disponibles, impidiendo que se acepten nuevas conexiones y causando una indisponibilidad completa del servicio. El upstream abord\u00f3 este problema en el commit bb7edc4; sin embargo, la \u00faltima versi\u00f3n estable (1.11.3) sigue afectada en el momento de la publicaci\u00f3n."}], "lastModified": "2026-06-17T10:44:29.553", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}