Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109438— 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4

Quick assessment

Affected
3proxy 3proxy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

3Proxy 0.9.7 至 1.0.1 版本（在 commit 206c923 中修复）存在一个未初始化栈内存泄露漏洞。当配置了外部 NAT 选项（-Ne）时，未认证的攻击者可通过 SOCKS4 回复路径泄露栈字节。攻击者可发送一个未能通过 SOCKS 版本检查的客户端探测包，从而触发包含 sin 结构体中未初始化字节的回复，暴露用户空间指针的高位字节，从而削弱 ASLR（地址空间布局随机化）的安全防护效果。

CVSS 5.3 · Medium EPSS 0.36% · P28

Possible ATT&CK Techniques 1 AI

T1572 · Protocol Tunneling

Affected Version Matrix 2

VendorProduct Version RangeStatus
3proxy 3proxy 0.9.7≤ 1.0.1 affected
206c923d6cd433bd2e7196375442650c328b8bfa unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109438

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
Source: CVE Program / CVE List V5
Vulnerability Description
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer that weakens ASLR protections.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对未经初始化资源的使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
3proxy 3proxy 0.9.7 ~ 1.0.1 -

II. Public POCs for CVE-2026-109438

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109438

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-109438 (1)

Other References for CVE-2026-109438 (1)

IV. Related Vulnerabilities

Same weakness: CWE-908

V. Comments for CVE-2026-109438

No comments yet

Leave a comment