GitHub Advisoryadvisory · Go

GHSA-xcf7-q56x-78gh github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion

HIGH Published 2021-07-26 Modified 2023-08-30 Official page ↗
Aliases
CVE-2021-23409
Ecosystem
Go
Packages
github.com/pires/go-proxyproto
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-07-26

Affected packages

• Go github.com/pires/go-proxyproto: < 0.6.1 → fixed in 0.6.1

Description

The package `github.com/pires/go-proxyproto` before 0.6.1 is vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. While this issue was patched in 0.6.0, the fix introduced additional issues which were subsequently patched in 0.6.1.

Related

Alias · CVE (1)

  • CVE-2021-23409 The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References