{"id":"CVE-2021-23351","aliases":["GHSA-fqh4-rh59-xhvf","SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1081577"],"url":"https://o3.security/vulnerability/CVE-2021-23351","summary":"github.com/pires/go-proxyproto denial of service vulnerability","details":"The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers.","published":"2021-03-08T05:15:12.593Z","modified":"2026-07-08T06:49:45.606596500Z","cvss":{"score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/pires/go-proxyproto","fixedVersion":"0.5.0"}],"fix":{"url":"https://github.com/pires/go-proxyproto/commit/7f48261db810703d173f27f3309a808cc2b49b8b","label":"pires/go-proxyproto@7f48261"},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BNVGJMVI3ZTZ675EFPUHPGXCKCGSX46/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36IBVOZXRTWM7MGTRUTOM56P5RR74VU/"},{"type":"ADVISORY","url":"https://github.com/pires/go-proxyproto/issues/69"},{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1081577"},{"type":"FIX","url":"https://github.com/pires/go-proxyproto/commit/7f48261db810703d173f27f3309a808cc2b49b8b"},{"type":"FIX","url":"https://github.com/pires/go-proxyproto/pull/71"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:49:45.606596500Z"}}