Read the docs
TI-2026-74171 Aliases CVE-2026-109438GHSA-4226-q7gw-49h8

3proxy SOCKS4 reply leaks uninitialized stack memory

Priority LOW 34CWE-908Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-908 and the CVSS impact.

Summary

3proxy from 0.9.7 through 1.0.1 (CWE-908, Use of Uninitialized Resource) leaks uninitialized stack memory to unauthenticated attackers through the SOCKS4 reply path when the external-NAT option (-Ne) is configured. A client probe that fails the SOCKS version check triggers a reply containing uninitialized bytes from the sin structure. The leaked bytes include high bytes of a userspace pointer, which weakens ASLR. CVSS 4.0 base score 6.3 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00359 29th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
3proxy3proxy0.9.7 – 1.0.1—Patch availableCNA
  • 3proxy Vendor3proxy Affected 0.9.7 – 1.0.1 Fixed in — Patch available CNA

Remediation

Apply the fix from commit 206c923 or upgrade to a 3proxy build that contains it. Red Hat lists one product as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-109438
  2. 2026-10-15 Alias added: GHSA-4226-q7gw-49h8
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: MEDIUM → LOW
  5. 2026-10-16 Affected versions changed · Red Hat
  6. 2026-10-16 CVSS score added · Red Hat

References

Patch 1

  • TI-2007-01953 Buffer overflow in the HTTP proxy service for 3proxy 0.5 to 0.5.3g, and 0.6b-devel before… CVSS 2.0HIGH 10.0
  • TI-2019-10808 webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface. CVSS 3.1CRITICAL 9.8
  • TI-2007-05403 Double free vulnerability in the ftpprchild function in ftppr in 3proxy 0.5 through… CVSS 2.0MEDIUM 5.0
  • TI-2006-06723 3proxy 0.5 to 0.5.2, when NT-encoded passwords are being used, allows remote attackers to… CVSS 2.0MEDIUM 5.0
  • TI-2006-06724 3proxy 0.5 to 0.5.2 does not offer NTLM authentication before basic authentication, which… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences