A critical integer overflow vulnerability in tinyproxy enables unauthenticated remote attackers to trigger a denial of service by exhausting available worker connections.

The vulnerability exists in the HTTP chunked transfer encoding parser, specifically within the src/reqs.c file, where chunk size values are processed using strtol without validating for integer overflow conditions. This flaw allows an unauthenticated remote attacker to send specifically crafted chunk sizes that cause connection exhaustion, ultimately rendering the proxy service unavailable.

The exploitation of this vulnerability results in a denial of service, which can cause significant operational disruption by preventing legitimate users from accessing proxied resources. Given the CVSS score of 7.5, this high severity flaw poses a substantial risk to service availability and business continuity for organizations relying on tinyproxy for network traffic management.

Immediate Action: Upgrade to the latest version of tinyproxy that incorporates the fixes provided in commit 969852c and bb7edc4. If an official package release is not yet available for your distribution, consider building from the latest source code.

Proactive Monitoring: Monitor proxy server logs and worker thread utilization for sudden spikes in connection counts or persistent connection timeouts that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or a network-level filter to inspect incoming HTTP traffic for anomalous chunked transfer encoding headers, which may help identify and block malicious requests before they reach the proxy parser.

Public Exploit Available: No (unknown)

This vulnerability represents a significant risk to the availability of network infrastructure. Security teams should prioritize patching affected tinyproxy instances immediately to prevent potential service disruptions. If immediate patching is not feasible, ensure that network access to the proxy is strictly limited to authorized clients to reduce the attack surface.