What is the CVSS score of CVE-2025-63938?

CVE-2025-63938 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Tinyproxy are affected by CVE-2025-63938?

Organizations using Tinyproxy through 1.11.2 should be aware of notable risk from CVE-2025-63938, a integer overflow vulnerability rated CVSS 6.5.. A patch is available.

Is there a public PoC exploit available for CVE-2025-63938?

Yes, a public proof-of-concept exploit is available for CVE-2025-63938. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-63938?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Tinyproxy CVE-2025-63938

MEDIUM

Integer Overflow or Wraparound (CWE-190)

2025-11-26 cve@mitre.org

Integer Overflow Buffer Overflow Tinyproxy Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:24 vuln.today

Patch released

Mar 28, 2026 - 19:24 nvd

Patch available

PoC Detected

Jan 02, 2026 - 20:48 vuln.today

Public exploit code

CVE Published

Nov 26, 2025 - 17:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.

AnalysisAI

Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Integer Overflow (CWE-190), which allows attackers to cause unexpected behavior through arithmetic overflow. Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. Affected products include: Tinyproxy Project Tinyproxy. Version information: through 1.11.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate arithmetic operations, use safe integer libraries, check bounds before allocation.