3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1f4dd1b9ff advisory.

    Update to 1.0.2 (rhbz#2560278)

    ----

    Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-540af356f2 advisory.

    Update to 1.0.2 (rhbz#2560278)

    ----

    Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1b5ddbaeb5 advisory.

    Update to 1.0.2 (rhbz#2560278)

    ----

    Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0d57adddb7 advisory.

    Automatic update for 3proxy-1.0.1-2.fc46.

    ##### **Changelog**

    ```
    * Thu Oct 22 2026 Tim Semeijn <tim@blsmk.eu> - 1.0.1-2
    - Patch CVE-2026-109438 (rhbz#2553107, rhbz#2553106)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
376331	Fedora 45 : 3proxy (2026-1f4dd1b9ff)	Nessus	Fedora Local Security Checks	Local	medium
376326	Fedora 43 : 3proxy (2026-540af356f2)	Nessus	Fedora Local Security Checks	Local	medium
376316	Fedora 44 : 3proxy (2026-1b5ddbaeb5)	Nessus	Fedora Local Security Checks	Local	medium
370894	Fedora 46 : 3proxy (2026-0d57adddb7)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-109438

medium

Tenable Plugins

medium

medium

medium

medium