{"id":"CVE-2025-63938","aliases":["DEBIAN-CVE-2025-63938","EUVD-2025-199723","GHSA-w547-jc37-w3cr","UBUNTU-CVE-2025-63938"],"status":"published","title":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port()...","description":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0028,"percentile":0.20777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2025-11-26T00:00:00Z","modified":"2026-11-04T23:10:00Z","fixes":[{"ecosystem":"Debian:14","package":"tinyproxy","fixed_in":["1.11.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.1-2.1","1.11.1-2.1+deb12u1","1.11.1-3","1.11.1-4","1.11.2-1","1.11.2-1~bpo12+1","1.11.3-1","1.11.3-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.2-1","1.11.3-1","1.11.3-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-1"}]}],"versions":["1.11.2-1","1.11.3-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-3ubuntu1","1.8.3-3ubuntu14.04.1~esm1","1.8.3-3ubuntu14.04.1~esm2","1.8.3-3ubuntu14.04.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-3ubuntu1","1.8.3-3ubuntu16.04.1~esm1","1.8.3-3ubuntu16.04.1~esm2","1.8.3-3ubuntu16.04.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.4-2","1.8.4-3","1.8.4-5","1.8.4-5ubuntu0.1~esm1","1.8.4-5ubuntu0.1~esm2","1.8.4-5ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-2","1.10.0-4","1.10.0-4ubuntu0.1","1.10.0-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-5","1.11.0-1","1.11.0-1ubuntu0.1~esm1","1.11.0-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.1-2.1","1.11.1-3","1.11.1-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tinyproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.2-1","1.11.2-1build1","1.11.3-1"]}],"products":[{"vendor":"tinyproxy_project","product":"tinyproxy"}],"references":[{"url":"https://github.com/tinyproxy/tinyproxy/issues/586","tags":["Exploit","Issue Tracking","Patch","report"]},{"url":"https://github.com/tinyproxy/tinyproxy/commit/3c0fde94981b025271ffa1788ae425257841bf5a","tags":["Patch","fix","report"]},{"url":"https://github.com/rayinaw/my-hub/blob/main/CVE-2025-63938/DISCLOSURE.md","tags":["Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63938","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w547-jc37-w3cr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/63xxx/CVE-2025-63938.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-63938","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-63938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-63938","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-63938","description":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.","status":"published","published":"2025-11-26T00:00:00Z","modified":"2025-11-26T16:45:07.159Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-199723","description":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.","status":"published","published":"2025-11-26T00:00:00Z","modified":"2025-11-26T16:45:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:12.440244Z"}],"ghsa":[{"id":"GHSA-w547-jc37-w3cr","title":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port()...","description":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.","status":"published","published":"2025-11-26T18:31:04Z","modified":"2025-11-26T18:31:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:04:58.071945Z"}],"nvd":[{"id":"CVE-2025-63938","description":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.","status":"published","published":"2025-11-26T17:15:46.44Z","modified":"2026-11-04T23:10:00.223Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T01:45:08.806554Z"}],"osv":[{"id":"CVE-2025-63938","description":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.","status":"published","published":"2025-11-26T00:00:00Z","modified":"2026-11-06T01:21:34.546732777Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T02:03:53.554046Z"},{"id":"DEBIAN-CVE-2025-63938","description":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.","status":"published","published":"2025-11-26T17:15:46.44Z","modified":"2026-11-05T09:47:39.141051039Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"UBUNTU-CVE-2025-63938","description":"Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.","status":"published","published":"2025-11-26T17:15:00Z","modified":"2026-10-17T12:57:11.226481169Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"}]}}