EUVD-2026-17066
GHSA-6vhj-8f7g-v7f7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with chunked transfer encoding
-
ExploitSpecify malicious chunk size as LONG_MAX value
-
ExecutionTrigger integer overflow in chunk size arithmetic
-
ImpactCause denial of service via resource exhaustion
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default installations of tinyproxy up to and including version 1.11.3. Attacker sends crafted HTTP request with oversized chunk size value (e.g., 0x7fffffffffffffff) in chunked transfer encoding to trigger integer overflow during parsing. |
| Exploit ScenarioDerived | An attacker sends an HTTP request to a tinyproxy server with a crafted chunk size value (0x7fffffffffffffff) in the Transfer-Encoding: chunked header. The parser fails to detect integer overflow during strtol() conversion and subsequent arithmetic, causing incorrect memory allocation or buffer handling that crashes the service or exhausts resources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 30, 2026
Remote denial of service in tinyproxy versions through 1.11.3 allows unauthenticated attackers to exhaust all proxy worker connections via malformed HTTP chunked transfer encoding. An integer overflow in chunk size parsing (using strtol() without ERANGE validation) enables attackers to send LONG_MAX values that bypass size checks and trigger arithmetic overflow during chunklen+2 calculations. This forces the proxy to attempt reading unbounded request body data, holding worker slots indefinitely until all connections are exhausted and new clients are rejected. Upstream fix available (commits bb7edc4, 969852c) but latest stable release 1.11.3 remains unpatched. EPSS data not available; no public exploit identified at time of analysis, though attack complexity is low (CVSS AC:L) and requires no authentication (PR:N).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Tinyproxy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol() without properly validating overflow conditions (e.g., errno == ERANGE). A crafted chunk size such as 0x7fffffffffffffff (LONG_MAX) bypasses the existing validation check (chunklen < 0), leading to a signed integer overflow during arithmetic operations (chunklen + 2). This results in incorrect size calculations, causing the proxy to attempt reading an extremely large amount of request-body data and holding worker connections open indefinitely. An attacker can exploit this behavior to exhaust all available worker slots, preventing new connections from being accepted and causing complete service unavailability. Upstream addressed this issue in commit bb7edc4; however, the latest stable release (1.11.3) remains affected at the time of publication.
Executive ViewAI
tinyproxy versions through 1.11.3 contain a remote denial-of-service vulnerability that allows unauthenticated attackers to exhaust proxy worker connections and block legitimate traffic by sending specially crafted HTTP requests. Organizations relying on tinyproxy for web traffic proxying face service unavailability risk until patching is completed.
Within 24 hours: inventory all tinyproxy deployments and document affected versions (1.11.3 and earlier). Within 7 days: upgrade to patched version (post-1.11.3 release containing commits bb7edc4 and 969852c) or apply vendor-provided security patches; test in non-production environment first. Within 30 days: verify all production instances are updated and monitor proxy connection logs for anomalous chunk encoding patterns.
If immediate patching is not possible: (1) implement connection-rate limiting per source IP at upstream firewall/load balancer; (2) configure tinyproxy with strict max-connections limits and request timeouts; (3) add WAF or reverse proxy rules to reject malformed chunked transfer encoding; (4) monitor worker connection pool saturation and alert on exhaustion; (5) schedule maintenance window for patching within 7 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used.
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.
HTTP request smuggling in Tinyproxy through 1.11.3 allows remote unauthenticated attackers to desynchronize the proxy an
HTTP request smuggling in Tinyproxy through 1.11.3 lets remote unauthenticated attackers desynchronize the proxy and bac
Authentication bypass in Tinyproxy through 1.11.3 lets unauthenticated remote attackers reach the internal statistics pa
HTTP request smuggling and denial of service in Tinyproxy through 1.11.3 allows unauthenticated remote attackers to caus
main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-roo
Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1.10.0-5 | - |
| bullseye (security) | vulnerable | 1.10.0-5+deb11u1 | - |
| bookworm, bookworm (security) | vulnerable | 1.11.1-2.1+deb12u1 | - |
| trixie | vulnerable | 1.11.2-1 | - |
| forky, sid | vulnerable | 1.11.3-1 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB