CVE-2025-54581

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-54581
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-54581.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-54581
Aliases
Published
2025-07-30T20:15:37Z
Modified
2025-07-31T20:50:56.495838Z
Summary
[none]
Details

vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::tryfrom and flows into parsettl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.

References

Affected packages

Git / github.com/0x676e67/vproxy

Affected ranges

Type
GIT
Repo
https://github.com/0x676e67/vproxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

v0.*

v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.5
v0.3.6
v0.3.7
v0.3.8

v1.*

v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.3.1
v1.3.2

v2.*

v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.25
v2.0.26
v2.0.5
v2.0.50
v2.0.51
v2.0.55
v2.0.60
v2.0.65
v2.0.77
v2.3.0
v2.3.1
v2.3.2
v2.3.3