vproxy
Activity
- Latest release
- 9mo ago
- Total releases
- 47
- Cadence
- ~4 days
- Last 12 months
- 5
Details
- License
- GPL-3.0
- First release
- May 03, 2024
| Version | Released | |
|---|---|---|
2.5.5
unknown
|
2.5.5
unknown
Dependencies (36)
+ 28 more |
|
2.5.3
unknown
|
2.5.3
unknown
Dependencies (35)
+ 27 more |
|
2.5.2
unknown
|
2.5.2
unknown
Dependencies (35)
+ 27 more |
|
2.5.1
unknown
|
2.5.1
unknown
Dependencies (35)
+ 27 more |
|
2.5.0
unknown
|
2.5.0
unknown
Dependencies (35)
+ 27 more |
|
2.4.4
unknown
|
2.4.4
unknown
Dependencies (34)
+ 26 more |
|
2.4.3
unknown
|
2.4.3
unknown
Dependencies (35)
+ 27 more |
|
2.4.5
unknown
yanked
|
2.4.5
unknown
yanked
Dependencies (35)
+ 27 more |
|
2.4.2
unknown
|
2.4.2
unknown
Dependencies (35)
+ 27 more |
|
2.4.1
unknown
|
2.4.1
unknown
Dependencies (35)
+ 27 more |
|
2.4.0
unknown
|
2.4.0
unknown
Dependencies (34)
+ 26 more |
|
2.3.3
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.3.3
unknown
Dependencies (34)
+ 26 more |
|
2.3.2
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.3.2
unknown
Dependencies (35)
+ 27 more |
|
2.3.1
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.3.1
unknown
Dependencies (35)
+ 27 more |
|
2.3.0
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.3.0
unknown
Dependencies (35)
+ 27 more |
|
2.0.77
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.77
unknown
Dependencies (34)
+ 26 more |
|
2.0.65
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.65
unknown
Dependencies (34)
+ 26 more |
|
2.0.60
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.60
unknown
Dependencies (34)
+ 26 more |
|
2.0.55
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.55
unknown
Dependencies (35)
+ 27 more |
|
2.0.51
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.51
unknown
Dependencies (35)
+ 27 more |
|
2.0.50
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.50
unknown
Dependencies (34)
+ 26 more |
|
2.2.0
unknown
yanked
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.2.0
unknown
yanked
Dependencies (34)
+ 26 more |
|
2.1.0
unknown
yanked
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.1.0
unknown
yanked
Dependencies (34)
+ 26 more |
|
2.0.26
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.26
unknown
Dependencies (34)
+ 26 more |
|
2.0.25
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.25
unknown
Dependencies (34)
+ 26 more |
|
2.0.12
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.12
unknown
Dependencies (34)
+ 26 more |
|
2.0.11
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.11
unknown
Dependencies (34)
+ 26 more |
|
2.0.10
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.10
unknown
Dependencies (34)
+ 26 more |
|
2.0.6
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.6
unknown
Dependencies (34)
+ 26 more |
|
2.0.5
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.5
unknown
Dependencies (34)
+ 26 more |
|
2.0.1
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.1
unknown
Dependencies (34)
+ 26 more |
|
2.0.0
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
2.0.0
unknown
Dependencies (34)
+ 26 more |
|
1.3.2
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.3.2
unknown
Dependencies (30)
+ 22 more |
|
1.3.1
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.3.1
unknown
Dependencies (30)
+ 22 more |
|
1.3.0
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.3.0
unknown
Dependencies (30)
+ 22 more |
|
1.2.6
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.2.6
unknown
Dependencies (30)
+ 22 more |
|
1.2.5
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.2.5
unknown
Dependencies (30)
+ 22 more |
|
1.2.4
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.2.4
unknown
Dependencies (30)
+ 22 more |
|
1.2.3
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.2.3
unknown
Dependencies (30)
+ 22 more |
|
1.2.1
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.2.1
unknown
Dependencies (30)
+ 22 more |
|
1.1.2
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.1.2
unknown
Dependencies (30)
+ 22 more |
|
1.1.1
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.1.1
unknown
Dependencies (30)
+ 22 more |
|
1.0.0
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
1.0.0
unknown
Dependencies (30)
+ 22 more |
|
0.3.7
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
0.3.7
unknown
Dependencies (30)
+ 22 more |
|
0.3.2
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
0.3.2
unknown
Dependencies (31)
+ 23 more |
|
0.2.2
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
0.2.2
unknown
Dependencies (30)
+ 22 more |
|
0.2.1
unknown
1 CVE
CVE-2025-54581
GHSA-7h24-c332-p48c
Jul 30, 2025
vproxy Divide by Zero DoS Vulnerability
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryUntrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state. DetailsUntrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. The code assumed to be responsible for this can be found here: https://github.com/0x676e67/vproxy/blob/ab304c3854bf8480be577039ada0228907ba0923/src/extension.rs#L173-L183 PoC
ImpactThe resulting crash renders the proxy server unusable until it is reset. Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon) Fixed in
2.4.0
References Updated Jul 31, 2025 · Source: OSV.dev |
0.2.1
unknown
Dependencies (30)
+ 22 more |