{"id":"GHSA-c2c3-pqw5-5p7c","summary":"Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times","details":"### Summary\n\nThe PROXY command is accepted multiple times, allowing a client to spoof its IP address when the proxy protocol is being used.\n\n### Details\n\nWhen ProxyOn is enabled, [it looks like the PROXY command will be accepted multiple times](https://github.com/phires/go-guerrilla/blob/fca3b2d8957a746997c7e71fca39004f5c96e91f/server.go#L495), with later invocations overriding earlier ones.  The proxy protocol only supports one initial PROXY header; anything after that is considered part of the exchange between client and server, so the client is free to send further PROXY commands with whatever data it pleases.  go-guerrilla will treat these as coming from the reverse proxy, allowing a client to spoof its IP address.\n\nNote that the format of the PROXY header is [well-defined](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt).  It probably shouldn't be treated as an SMTP command; parsing it the same way is likely to result in odd behavior and could lead to other vulnerabilities.\n\n### PoC\n\nI'm working on writing a PR to fix this vulnerability.  It'll include a unit test that will serve as a PoC on the current version.\n\n### Impact\n\nAny instance with `ProxyOn` enabled (`proxyon` in the JSON config) is affected.\n\nAs far as I'm able to tell, the impact is limited to spoofing the `RemoteIP` field.  This isn't ideal, but it probably has less practical impact on an MTA than, say, a web server.","aliases":["CVE-2025-31135","GO-2025-3588"],"modified":"2026-06-08T16:00:10.310411354Z","published":"2025-04-01T22:23:49Z","database_specific":{"github_reviewed_at":"2025-04-01T22:23:49Z","nvd_published_at":"2025-04-01T22:15:21Z","cwe_ids":["CWE-20"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31135"},{"type":"WEB","url":"https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6"},{"type":"PACKAGE","url":"https://github.com/phires/go-guerrilla"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2025-3588"}],"affected":[{"package":{"name":"github.com/phires/go-guerrilla","ecosystem":"Go","purl":"pkg:golang/github.com/phires/go-guerrilla"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-c2c3-pqw5-5p7c/GHSA-c2c3-pqw5-5p7c.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}