{"id":"CVE-2021-23409","aliases":["DEBIAN-CVE-2021-23409","EUVD-2021-1500","GHSA-xcf7-q56x-78gh","GO-2022-0233","SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439","UBUNTU-CVE-2021-23409"],"status":"published","title":"Denial of Service (DoS)","description":"The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01648,"percentile":0.7666,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-07-21T06:45:18Z","modified":"2026-10-23T18:04:49Z","fixes":[{"ecosystem":"Go","package":"github.com/pires/go-proxyproto","fixed_in":["0.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"golang-github-pires-go-proxyproto","fixed_in":["0.4.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-pires-go-proxyproto","fixed_in":["0.4.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-pires-go-proxyproto","fixed_in":["0.4.2-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/pires/go-proxyproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-pires-go-proxyproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-pires-go-proxyproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-pires-go-proxyproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/pires/go-proxyproto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/pires/go-proxyproto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-pires-go-proxyproto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-1"]}],"products":[{"vendor":"go-proxyproto_project","product":"go-proxyproto"}],"references":[{"url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/pires/go-proxyproto/releases/tag/v0.6.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/pires/go-proxyproto/issues/65","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/pires/go-proxyproto/pull/74","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/pires/go-proxyproto/pull/74/commits/cdc63867da24fc609b727231f682670d0d1cd346","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23409","tags":["advisory"]},{"url":"https://github.com/pires/go-proxyproto/issues/75","tags":["web"]},{"url":"https://github.com/pires/go-proxyproto/releases/tag/v0.6.1","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0233","tags":["web"]},{"url":"https://github.com/pires/go-proxyproto/pull/76","tags":["web"]},{"url":"https://github.com/pires/go-proxyproto/commit/2e44d7a76a851d66890ab341403253afae5caac2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xcf7-q56x-78gh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23409","tags":["advisory"]},{"url":"https://github.com/pires/go-proxyproto","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-23409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23409","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-23409","title":"Denial of Service (DoS)","description":"The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.","status":"published","published":"2021-07-21T06:45:18.241Z","modified":"2024-09-16T20:07:39.351Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-1500","description":"The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.","status":"published","published":"2021-07-21T06:45:18Z","modified":"2024-09-16T20:07:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:16.813871Z"}],"ghsa":[{"id":"GHSA-xcf7-q56x-78gh","title":"github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion","description":"The package `github.com/pires/go-proxyproto` before 0.6.1 is vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. While this issue was patched in 0.6.0, the fix introduced additional issues which were subsequently patched in 0.6.1.","status":"published","published":"2021-07-26T21:23:49Z","modified":"2023-08-30T18:51:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2021-23409","description":"The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.","status":"published","published":"2021-07-21T07:15:07.547Z","modified":"2026-06-17T03:38:42.72Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"CVE-2021-23409","description":"The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.","status":"published","published":"2021-07-21T07:15:07.547Z","modified":"2026-10-20T10:54:32.439090767Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-23409","description":"The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.","status":"published","published":"2021-07-21T07:15:07.547Z","modified":"2026-10-23T18:04:49.861131661Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-xcf7-q56x-78gh","title":"github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion","description":"The package `github.com/pires/go-proxyproto` before 0.6.1 is vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. While this issue was patched in 0.6.0, the fix introduced additional issues which were subsequently patched in 0.6.1.","status":"published","published":"2021-07-26T21:23:49Z","modified":"2026-09-10T03:49:15.401177543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"UBUNTU-CVE-2021-23409","description":"The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.","status":"published","published":"2021-07-21T07:15:00Z","modified":"2025-09-08T16:46:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"GO-2022-0233","title":"Resource exhaustion in github.com/pires/go-proxyproto","description":"The PROXY protocol server does not impose a timeout on reading the header from new connections, allowing a malicious client to cause resource exhaustion and a denial of service by opening many connections and sending no data on them.\n\nv0.6.0 of the proxyproto package adds support for a user-defined header timeout. v0.6.1 adds a default timeout of 200ms and v0.6.2 increases the default timeout to 10s.","status":"published","published":"2022-07-01T20:18:04Z","modified":"2026-03-13T22:10:56.050343Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}