CVE-2026-109438

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109438
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109438.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109438
Published
2026-10-14T15:53:36Z
Modified
2026-10-15T02:47:39Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
Details

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-908"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109438.json"
}
References

Affected packages

Git / github.com/3proxy/3proxy

Affected ranges

Type
GIT
Repo
https://github.com/3proxy/3proxy
Events
Introduced
19cacf0bd9022d29362101dd292c0eea42129a5d
Last Affected
f271a57238662a219f0b2f00c85788a5fa4edb62
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.9.7"
        },
        {
            "last_affected":  "1.0.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.9.7
0.9.8
0.9.9
1.*
1.0.0
1.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109438.json"