CVE-2026-109438 3proxy CVE debrief

Who should care

Defenders responsible for 3proxy installations, particularly those using versions 0.9.7 through 1.0.1, should assess exposure and apply the patch commit (206c923) to mitigate the vulnerability.

Why it matters

Defenders should care about CVE-2026-109438 because it allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path in 3proxy versions 0.9.7 through 1.0.1. This vulnerability can potentially weaken ASLR protections and lead to information disclosure. Affected 3proxy installations should be identified and patched with commit 206c923.

• Potential exposure of stack memory, weakening ASLR protections.
• Possible information disclosure via uninitialized stack bytes.

Technical summary

The 3proxy service is vulnerable to an uninitialized stack memory disclosure via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. An attacker can send a client probe that fails the SOCKS version check to trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer. This can potentially weaken ASLR protections and lead to information disclosure. The vulnerability affects 3proxy versions 0.9.7 through 1.0.1, fixed in commit 206c923. Defenders should assess exposure and apply the patch commit (206c923) to mitigate the vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch commit (206c923) to vulnerable 3proxy installations.
• Restrict access to SOCKS4 services to trusted users only.
• Monitor 3proxy logs for unusual activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability was fixed in commit 206c923. There are no known exploits or reports of the vulnerability being used in attacks. The vulnerability affects 3proxy versions 0.9.7 through 1.0.1. Defenders should verify the patch commit (206c923) and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.