Medium severity · published Oct 14, 2026
CVE-2026-109438
3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3P
3proxy · 3proxy
0.9.7 through 1.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109438
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109438
patch
https://github.com/3proxy/3proxy/commit/206c923d6cd433bd2e7196375442650c328b8bfa
third-party-advisory
https://www.vulncheck.com/advisories/3proxy-uninitialized-stack-memory-disclosure-via-socks4
More from 3proxy
9.8
CVE-2019-14495
webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface
–
CVE-2007-5622
Double free vulnerability in the ftpprchild function in ftppr in 3proxy 0.5 through 0.5.3i allows remote attackers to cause a denial of service (daemon crash) via multiple OPEN…
–
CVE-2007-2031
Buffer overflow in the HTTP proxy service for 3proxy 0.5 to 0.5.3g, and 0.6b-devel before 20070413, might allow remote attackers to execute arbitrary code via crafted transparent…
–
CVE-2006-6981
3proxy 0.5 to 0.5.2, when NT-encoded passwords are being used, allows remote attackers to cause a denial of service (blocked account) via unspecified vectors related to NTLM…
–
CVE-2006-6982
3proxy 0.5 to 0.5.2 does not offer NTLM authentication before basic authentication, which might cause browsers with incomplete RFC2616/RFC2617 support to use basic cleartext…