An integer overflow occurs in Tinyproxy's HTTP chunked transfer encoding parser when parsing chunk size values. The vulnerability allows an unauthenticated remote attacker to send a crafted chunk size that overflows during arithmetic operations, leading the proxy to calculate an enormous request-body size and keep worker connections open. The result is a denial of service, as all worker slots can be exhausted, preventing new connections from being accepted and rendering the proxy unavailable.

The product affected is the Tinyproxy proxy server. Versions up to and including 1.11.3 lack the necessary overflow check. The issue applies to the Tinyproxy Tinyproxy package used across all supported platforms.

The CVSS base score of 8.7 indicates high severity, and the vulnerability is exploitable remotely without authentication by sending a specially crafted HTTP request. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an unauthenticated HTTP client that can send a large chunk size value, bypassing the validation and causing the proxy to enter a crash or hang state, thus impacting service availability.