An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol() without properly validating overflow conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt reading an extremely large amount of request-body data and holding worker connections open indefinitely. An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections from being accepted and causing complete service unavailability. Upstream addressed this issue in commit bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d8daf8790f advisory.

    Backport upstream fixes for CVE-2026-3945 and CVE-2026-31842.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c7a717dbc advisory.

    Automatic update for tinyproxy-1.11.3-2.fc45.

    ##### **Changelog**

    ```
    * Wed Apr  8 2026 Carl George <carlwgeorge@fedoraproject.org> - 1.11.3-2
    - Backport upstream CVE fixes
    - Fixes rhbz#2452969 CVE-2026-3945
    - Fixes rhbz#2455913 CVE-2026-31842
    - Run upstream test suite

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20456-1 advisory.

    Changes in tinyproxy:

    - CVE-2026-3945: Fixed denial of service by unauthenticated remote attacker (boo#1261024)

    - Update to release 1.11.3
      * conf: add BasicAuthRealm feature
      * basic auth: fix error status 401 vs 407
      * tinyproxy.conf.5: explain what a site_spec looks like
      * tinyproxy.conf.5: add an IPv6 example to allow/deny section
      * reqs: fix integer overflow in port number processing

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and     including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The     issue occurs because chunk size values are parsed using strtol() without properly validating overflow     conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses     the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic     operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt     reading an extremely large amount of request-body data and holding worker connections open indefinitely.
    An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections     from being accepted and causing complete service unavailability. Upstream addressed this issue in commit     bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication.
    (CVE-2026-3945)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
307695	Fedora 43 : tinyproxy (2026-d8daf8790f)	Nessus	Fedora Local Security Checks	high
305657	Fedora 45 : tinyproxy (2026-1c7a717dbc)	Nessus	Fedora Local Security Checks	high
304863	openSUSE 16 Security Update : tinyproxy (openSUSE-SU-2026:20456-1)	Nessus	SuSE Local Security Checks	high
304365	Linux Distros Unpatched Vulnerability : CVE-2026-3945	Nessus	Misc.	high

Detections

Analytics

CVE-2026-3945

high

Tenable Plugins

high

high

high

high