An integer overflow exists in the HTTP chunked transfer parsing logic of Tinyproxy version 1.11.3 and earlier. The parser converts chunk size values using strtol without validating overflow, allowing a crafted chunk size to exceed the limits of a signed integer. When this overflow occurs, Tinyproxy miscomputes the request body length, causing a worker thread to wait for an excessively large body and draw down all available worker slots. The result is a denial of service that renders the proxy unable to accept new connections until the workers reset.

The vulnerability affects the Tinyproxy proxy server from the vendor tinyproxy:tinyproxy, specifically all releases up to and including version 1.11.3. The issue applies to deployments on any supported operating system where the server processes HTTP requests with chunked transfer encoding.

The CVSS base score of 8.7 indicates high severity, and the EPSS score of less than 1% suggests a low probability of current exploitation, though the flaw remains publicly known. The vulnerability is exploitable remotely without authentication by an attacker who can send a specially crafted HTTP request containing an oversized chunk size. The attack vector is an unauthenticated HTTP client; successful exploitation consumes all worker threads, causing a denial of service. The flaw is not listed in the CISA KEV catalog.