Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/phires/go-guerrilla

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3GoPublished

    Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times

    CVE-2025-31135 · GHSA-c2c3-pqw5-5p7c

    Affected
    • Go github.com/phires/go-guerrilla < 1.6.7
    Fixed in
    1.6.7· Vendor fix available
    Issue
    The PROXY command is accepted multiple times, allowing a client to spoof its IP address when the proxy protocol is being used. Details When ProxyOn is enabled, it looks like the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is considered part of the exchange between client and server, so the client is free to send further PROXY commands with whatever data it pleases. go-guerrilla will treat these as coming from the reverse proxy, allowing a client to spoof its IP address. Note that the format of the PROXY header is well-defined. It probably shouldn't be treated as an SMTP command; parsing it the same way is likely to result in odd behavior and could lead to other vulnerabilities. PoC I'm working on writing a PR to fix this vulnerability. It'll include a unit test that will serve as a PoC on the current version. Impact Any instance with ProxyOn…

    Recommended action: Upgrade to 1.6.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →