Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3proxy | 3proxy | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections. | |
| Title | 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4 | |
| Weaknesses | CWE-908 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-14T15:53:36.065Z
Reserved: 2026-10-12T15:52:36.682Z
Link: CVE-2026-109438
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T16:17:36.783
Modified: 2026-10-14T16:17:36.783
Link: CVE-2026-109438
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-908
Use of Uninitialized Resource