{"id":"GO-2022-0233","summary":"Resource exhaustion in github.com/pires/go-proxyproto","details":"The PROXY protocol server does not impose a timeout on reading the header from new connections, allowing a malicious client to cause resource exhaustion and a denial of service by opening many connections and sending no data on them.\n\nv0.6.0 of the proxyproto package adds support for a user-defined header timeout. v0.6.1 adds a default timeout of 200ms and v0.6.2 increases the default timeout to 10s.","aliases":["CVE-2021-23409","GHSA-xcf7-q56x-78gh"],"modified":"2026-03-13T22:10:56.050343Z","published":"2022-07-01T20:18:04Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2022-0233"},"references":[{"type":"FIX","url":"https://github.com/pires/go-proxyproto/pull/74"},{"type":"FIX","url":"https://github.com/pires/go-proxyproto/pull/74/commits/cdc63867da24fc609b727231f682670d0d1cd346"},{"type":"WEB","url":"https://github.com/pires/go-proxyproto/issues/65"}],"affected":[{"package":{"name":"github.com/pires/go-proxyproto","ecosystem":"Go","purl":"pkg:golang/github.com/pires/go-proxyproto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/pires/go-proxyproto","symbols":["Listener.Accept"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2022-0233.json"}}],"schema_version":"1.7.5"}