Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

letmeinfwd

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.6crates.ioPublished

    letmein connection limiter allows an arbitrary amount of simultaneous connections

    CVE-2025-52570 · GHSA-jpv7-p47h-f43j

    Affected
    • crates.io letmeinfwd <= 10.2.0
    Fixed in
    10.2.1· Vendor fix available
    Issue
    Impact The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections (TCP, UDP and Unix socket) for the services letmeind and letmeinfwd. Therefore, the command line option num-connections is not effective and does not limit the number of simultaneously incoming connections. letmeind is the public network facing daemon (TCP/UDP). letmeinfwd is the internal firewall daemon that only listens on local Unix socket. Possible Denial Of Service by resource exhaustion. Affected versions All versions <= 10.2.0 are affected. Patches All users shall upgrade to version 10.2.1. Workarounds Untested possible workarounds: - It might be possible to limit the number of active connections to the letmeind port (default 5800) via firewall. - The resource consumption of the service might be restricted with a service manager such as systemd. Severity: If a (D)DoS is run against the service, something is going to be affected. The connection limiter…

    Recommended action: Upgrade to 10.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →