CVE-2026-3945

HighCVSS 7.5/10Last modified Aug 10, 2026

Description

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Mar 30, 2026
Last modified: Aug 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-394507.1Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.CVE-2026-394516.3Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.CVE-2026-394527.3Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applications may allow an esca CVE-2026-394538.3Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create D CVE-2026-394548.5SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission set CVE-2026-394557.5When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic CVE-2026-394577.8When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socke CVE-2026-394587.5When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), u CVE-2026-394597.2A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manage CVE-2026-39463.5A vulnerability was detected in PHPEMS 11.0. The affected element is an unknown function of the file /index.php?ask=app-ask. Performing a ma CVE-2026-394608.1Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrato CVE-2026-394618.8libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become avail