CVE-2021-23409 Denial of Service (DoS)
Attackers can cause denial of service in applications using the go-proxyproto library by establishing connections without the required proxy protocol header.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23409?
CVE-2021-23409 is a high-severity denial of service vulnerability in github.com/pires/go-proxyproto, published on 21 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.
Which versions are affected by CVE-2021-23409?
3 open source packages ship an affected version, including github.com/pires/go-proxyproto. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pires/go-proxyproto Go | All versions | 0.6.1 |
github.com/pires/go-proxyproto Go | All versions | 0.6.1 |
github.com/pires/go-proxyproto Go | All versions | 0.6.1 |
Products include Go-Proxyproto Project Go-Proxyproto.
How do I fix CVE-2021-23409?
Upgrade github.com/pires/go-proxyproto to 0.6.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-23409 being exploited?
There is no known exploitation of CVE-2021-23409 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2021-23409, GHSA-xcf7-q56x-78gh, GO-2022-0233, SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439, UBUNTU-CVE-2021-23409.