Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/apernet/hysteria/core/v2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.4GoPublished

    Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF

    GHSA-vgrc-hq28-p3xp

    Affected
    • Go github.com/apernet/hysteria/core/v2 >= 2.0.0, <= 2.9.1
    Fixed in
    2.9.2· Vendor fix available
    Issue
    Hysteria's UDP relay treats the destination address as packet-scoped, but ACL and outbound policy are applied only once when a new UDP session is created. After an authenticated client opens a UDP session using an allowed first destination, later packets in the same Session ID can be sent to different destinations without re-running ACL evaluation. This allows an authenticated user to bypass server-side UDP ACL rules and reach localhost or RFC1918/private-network UDP services from the server's network perspective, even when those destinations are explicitly rejected by ACL. Verified on current HEAD at commit 64c396385631579598cc29d5561bff98c439772f. Why this is a security issue This report is not based on the assumption that one UDP session must be bound to one destination. The protocol and official client both support per-packet destinations: - PROTOCOL.md:93-107 defines each UDPMessage as carrying its own Addr field. - core/client/udp.go:52-62 exposes Send(data, addr),…

    Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →