{"id":"CVE-2025-31135","aliases":["GHSA-c2c3-pqw5-5p7c","GO-2025-3588"],"url":"https://o3.security/vulnerability/CVE-2025-31135","summary":"Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times","details":"### Summary\n\nThe PROXY command is accepted multiple times, allowing a client to spoof its IP address when the proxy protocol is being used.\n\n### Details\n\nWhen ProxyOn is enabled, [it looks like the PROXY command will be accepted multiple times](https://github.com/phires/go-guerrilla/blob/fca3b2d8957a746997c7e71fca39004f5c96e91f/server.go#L495), with later invocations overriding earlier ones.  The proxy protocol only supports one initial PROXY header; anything after that is considered part of the exchange between client and server, so the client is free to send further PROXY commands with whatever data it pleases.  go-guerrilla will treat these as coming from the reverse proxy, allowing a client to spoof its IP address.\n\nNote that the format of the PROXY header is [well-defined](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt).  It probably shouldn't be treated as an SMTP command; parsing it the same way is likely to result in odd behavior and could lead to other vulnerabilities.\n\n### PoC\n\nI'm working on writing a PR to fix this vulnerability.  It'll include a unit test that will serve as a PoC on the current version.\n\n### Impact\n\nAny instance with `ProxyOn` enabled (`proxyon` in the JSON config) is affected.\n\nAs far as I'm able to tell, the impact is limited to spoofing the `RemoteIP` field.  This isn't ideal, but it probably has less practical impact on an MTA than, say, a web server.","published":"2025-04-01T22:03:09.405Z","modified":"2026-08-12T03:51:33.475336774Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.00356,"percentile":0.28253,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/phires/go-guerrilla","fixedVersion":"1.6.7"}],"fix":{"url":"https://github.com/phires/go-guerrilla/commit/d08fe22f8022d2bdedc136f9e4ba96f2fbbebf18","label":"phires/go-guerrilla@d08fe22"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31135.json"},{"type":"ADVISORY","url":"https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31135"},{"type":"FIX","url":"https://github.com/phires/go-guerrilla/commit/d08fe22f8022d2bdedc136f9e4ba96f2fbbebf18"},{"type":"WEB","url":"https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6"},{"type":"PACKAGE","url":"https://github.com/phires/go-guerrilla"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2025-3588"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:33.475336774Z"}}