{"id":"CVE-2025-54581","aliases":["EUVD-2025-23192","GHSA-7h24-c332-p48c"],"status":"published","title":"vproxy is vulnerable to a divide by zero DoS attack","description":"vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00642,"percentile":0.51118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2025-07-30T16:33:41Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"crates.io","package":"vproxy","fixed_in":["2.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"vproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.3"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"vproxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]}],"products":[{"vendor":"0x676e67","product":"vproxy"}],"references":[{"url":"https://github.com/0x676e67/vproxy/security/advisories/GHSA-7h24-c332-p48c","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/0x676e67/vproxy/commit/aa1bf64c5e7f1c471395f9f29175ffc1b16a1079","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/0x676e67/vproxy/releases/tag/v2.4.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54581","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7h24-c332-p48c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54581.json","tags":["advisory"]},{"url":"https://github.com/0x676e67/vproxy","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-54581","title":"vproxy is vulnerable to a divide by zero DoS attack","description":"vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.","status":"published","published":"2025-07-30T19:57:46.454Z","modified":"2025-07-30T20:23:36.826Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2025-23192","description":"vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.","status":"published","published":"2025-07-30T19:57:46Z","modified":"2025-07-30T20:23:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:02.888981Z"}],"ghsa":[{"id":"GHSA-7h24-c332-p48c","title":"vproxy Divide by Zero DoS Vulnerability","description":"### Summary\nUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state.\n\n### Details\nUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service.\n\nThe code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183\n\n### PoC\n1. Download and run the latest version of vproxy\n2. Send a cUrl request like the following, adjusting address and port as necessary: ```curl -x \"http://test-ttl-0:test@127.0.0.1:8101\" https://google.com```\n3. Wait for a cUrl error indicating \"Proxy CONNECT aborted\"\n4. View logs from the vproxy server\n5. Observe that the vproxy server crashed due to a divide-by-zero panic\n\n### Impact\nThe resulting crash renders the proxy server unusable until it is reset.\n\nFinally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon ([dbohannon](https://github.com/dbohannon))","status":"published","published":"2025-07-30T16:33:41Z","modified":"2025-08-21T17:23:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:38:54.795089Z"}],"nvd":[{"id":"CVE-2025-54581","description":"vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.","status":"published","published":"2025-07-30T20:15:37.907Z","modified":"2026-06-17T09:40:20.523Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"CVE-2025-54581","title":"vproxy is vulnerable to a divide by zero DoS attack","description":"vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.","status":"published","published":"2025-07-30T19:57:46.454Z","modified":"2026-10-28T02:30:24.947544008Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"GHSA-7h24-c332-p48c","title":"vproxy Divide by Zero DoS Vulnerability","description":"### Summary\nUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state.\n\n### Details\nUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service.\n\nThe code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183\n\n### PoC\n1. Download and run the latest version of vproxy\n2. Send a cUrl request like the following, adjusting address and port as necessary: ```curl -x \"http://test-ttl-0:test@127.0.0.1:8101\" https://google.com```\n3. Wait for a cUrl error indicating \"Proxy CONNECT aborted\"\n4. View logs from the vproxy server\n5. Observe that the vproxy server crashed due to a divide-by-zero panic\n\n### Impact\nThe resulting crash renders the proxy server unusable until it is reset.\n\nFinally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon ([dbohannon](https://github.com/dbohannon))","status":"published","published":"2025-07-30T16:33:41Z","modified":"2025-07-31T11:18:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}