CVE catalog

CVE-2021-23409

golang-github-pires-go-proxyproto: CVE-2021-23409

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.65% · Oct 25, 2026

The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-pires-go-proxyprotosid0.11.0-1fixed
Debiangolang-github-pires-go-proxyprotoforky0.11.0-1fixed
Debiangolang-github-pires-go-proxyprototrixie0.7.0-1fixed
Debiangolang-github-pires-go-proxyprotobookworm0.4.2-3fixed
Ubuntugolang-github-pires-go-proxyproto22.040.4.2-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-pires-go-proxyprotosourcesid0.4.2-2not yet assignedNot reported[991498]
Debiangolang-github-pires-go-proxyprotosourceforky0.4.2-2not yet assignedNot reported[991498]
Debiangolang-github-pires-go-proxyprotosourcetrixie0.4.2-2not yet assignedNot reported[991498]
Debiangolang-github-pires-go-proxyprotosourcebookworm0.4.2-2not yet assignedNot reported[991498]

[Debian bug #991498]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-pires-go-proxyproto-dev]Fixed

    Source package: [golang-github-pires-go-proxyproto]

    Details (2)

    • 0.4.2-3 · all · bookworm

      Fixed · Fixed: 0.4.2-2

      dsa · golang-github-pires-go-proxyproto · debian · bookworm; dsa · golang-github-pires-go-proxyproto · debian · 12

    • 0.4.2-3 · all · bookworm

      Fixed · Fixed: 0.4.2-2

      dsa · golang-github-pires-go-proxyproto · debian · bookworm; dsa · golang-github-pires-go-proxyproto · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-pires-go-proxyproto-dev]Fixed

    Source package: [golang-github-pires-go-proxyproto]

    Details (4)

    • 0.7.0-1 · all · trixie

      Fixed · Fixed: 0.4.2-2

      dsa · golang-github-pires-go-proxyproto · debian · 13

    • 0.7.0-1 · all · trixie

      Fixed · Fixed: 0.4.2-2

      dsa · golang-github-pires-go-proxyproto · debian · 13

    • 0.11.0-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 0.4.2-2

      dsa · golang-github-pires-go-proxyproto · debian · 13

    • 0.11.0-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 0.4.2-2

      dsa · golang-github-pires-go-proxyproto · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]