CVE-2026-3945: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3945 is an integer overflow vulnerability in the HTTP chunked transfer encoding parser of tinyproxy, affecting all versions up to and including 1.11.3. An unauthenticated remote attacker can exploit this flaw to cause a denial of service (DoS) by exhausting all available worker connection slots. The vulnerability was reported by TuranSec on March 28, 2026, disclosed publicly on March 30, 2026, and addressed upstream in commit bb7edc4 (merged March 29, 2026), though the latest stable release (1.11.3) remained affected at the time of publication. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat CVE, GitHub Advisory).

The root cause is an integer overflow or wraparound (CWE-190) in src/reqs.c within the pull_client_data_chunked() function. Chunk size values are parsed using strtol() without checking for overflow conditions (i.e., errno == ERANGE is not validated). A crafted chunk size of 0x7fffffffffffffff (LONG_MAX) passes the existing chunklen < 0 guard check, but the subsequent arithmetic chunklen + 2 wraps around, producing an incorrect (very large) size value. This causes tinyproxy to attempt reading an enormous amount of request-body data, holding the worker connection open indefinitely. The fix in commit bb7edc4 adds an upper-bound check: if (chunklen < 0 || chunklen > 0x0fffffff) goto ERROR_EXIT;, preventing both negative and excessively large values (GitHub Issue #602, GitHub PR #603, Commit bb7edc4).

Successful exploitation causes complete service unavailability of the tinyproxy instance. By sending multiple crafted HTTP requests with oversized chunk values, an attacker can exhaust all worker slots, preventing any new legitimate connections from being accepted. There is no confidentiality or integrity impact — the vulnerability is purely an availability (DoS) issue affecting any system running tinyproxy ≤ 1.11.3 as a proxy service (Red Hat CVE, GitHub Issue #602).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of publication. The vulnerability requires no authentication, no user interaction, and has low attack complexity — any network-accessible tinyproxy instance is potentially reachable. The EPSS score is approximately 0.048% (low probability of near-term exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs: 304365, 304863, 305657, 310435) and Qualys (ID: 288568) (Red Hat CVE, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible tinyproxy instances (version ≤ 1.11.3) using tools like Shodan, Censys, or nmap targeting common tinyproxy ports (default: 8888).
2. Craft malicious HTTP request: Construct an HTTP request using chunked transfer encoding (Transfer-Encoding: chunked) directed through the proxy, with a chunk size value of 7fffffffffffffff (LONG_MAX in hexadecimal).
3. Send request to tinyproxy: Transmit the crafted request to the tinyproxy listener. The parser reads the chunk size via strtol(), which returns LONG_MAX without triggering the chunklen < 0 guard.
4. Trigger integer overflow: The arithmetic chunklen + 2 overflows, causing tinyproxy to attempt reading an astronomically large body, blocking the worker connection indefinitely.
5. Repeat to exhaust workers: Send the crafted request repeatedly (up to the configured MaxClients limit) to occupy all worker slots, causing complete denial of service for legitimate users (GitHub Issue #602, Commit bb7edc4).

• Network: High volume of persistent, long-lived TCP connections to the tinyproxy port (default 8888) from one or more source IPs; HTTP requests with Transfer-Encoding: chunked headers containing abnormally large chunk size values (e.g., 7fffffffffffffff).
• Logs: Tinyproxy access logs showing numerous requests that never complete or close; connections remaining open far beyond normal timeout thresholds; repeated connections from the same source IP.
• Process: Tinyproxy worker processes stuck in a read/wait state; system resource monitors showing tinyproxy consuming all configured connection slots (MaxClients reached); new connections being refused while existing ones remain open indefinitely.

The upstream fix is available in commit bb7edc4 on the tinyproxy master branch, which adds an upper-bound check (chunklen > 0x0fffffff) to the chunk size validation in src/reqs.c. Users should build tinyproxy from the patched source or wait for a new stable release beyond 1.11.3. As a network-level workaround, restrict access to the tinyproxy port using firewall rules to trusted IP ranges, and consider setting a low MaxClients value combined with connection rate limiting to reduce the impact of connection exhaustion attacks. OpenSUSE has issued a security update addressing this issue (OpenSUSE Advisory, Red Hat CVE, Commit bb7edc4).

The vulnerability was assigned by TuranSec (CNA) and reported via a GitHub issue on March 28, 2026, with the upstream maintainer (rofl0r) merging a fix the following day. The OpenSUSE security team issued a distribution-level advisory, and Fedora also released updates addressing the flaw. Coverage appeared on Linux-focused news outlets including linuxcompatible.org and pro-linux.de. Community reaction was measured, reflecting the limited scope (DoS only, no code execution) and the availability of a patch (OpenSUSE Advisory, GitHub PR #603).