CVE-2025-54581 vproxy is vulnerable to a divide by zero DoS attack
An attacker can crash the vproxy server by sending a crafted HTTP Proxy-Authorization header with a zero TTL value, causing a division by zero panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54581?
CVE-2025-54581 is a high-severity denial of service vulnerability in 0x676e67 vproxy, published on 30 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.
Weakness: CWE-369
Which versions are affected by CVE-2025-54581?
2 open source packages ship an affected version, including vproxy.
| Package | Affected | Fixed in |
|---|---|---|
vproxy crates.io | All versions | 2.4.0 |
vproxy crates.io | All versions | 2.4.0 |
How do I fix CVE-2025-54581?
Upgrade vproxy to 2.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-54581 being exploited?
There is no known exploitation of CVE-2025-54581 in the wild and no public exploit code.
Sources
Also known as GHSA-7h24-c332-p48c.