CVE catalog

CVE-2025-34451

proxychains-ng affected and fixed versions

[CVE catalog]

rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflow vulnerability in the function proxy_from_string() located in src/libproxychains.c. When parsing crafted proxy configuration entries containing overly long username or password fields, the application may write beyond the bounds of fixed-size stack buffers, leading to memory corruption or crashes. This vulnerability may allow denial of service and, under certain conditions, could be leveraged for further exploitation depending on the execution environment and applied mitigations.

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.27% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence
Original provider fields
{
  "package_releases": [
    {
      "name": "proxychains-ng",
      "status": "fixed",
      "release": "sid",
      "version": "4.17-4"
    },
    {
      "name": "proxychains-ng",
      "status": "fixed",
      "release": "forky",
      "version": "4.17-4"
    },
    {
      "name": "proxychains-ng",
      "status": "vulnerable",
      "release": "trixie",
      "version": "4.17-3"
    },
    {
      "name": "proxychains-ng",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "4.16-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1123676,
      "name": "proxychains-ng",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "4.17-3.1"
    },
    {
      "bug": 1123676,
      "name": "proxychains-ng",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "4.17-3.1"
    },
    {
      "bug": 1123676,
      "name": "proxychains-ng",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1123676,
      "name": "proxychains-ng",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": []
}

[Debian bug #1123676]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libproxychains4]Unknown

    Source package: [proxychains-ng]

    Details (2)

    • 4.16-2 · amd64 · bookworm

      Affected

      dsa · proxychains-ng · debian · bookworm; dsa · proxychains-ng · debian · 12

    • 4.16-2 · arm64 · bookworm

      Affected

      dsa · proxychains-ng · debian · bookworm; dsa · proxychains-ng · debian · 12

  • [proxychains4]Unknown

    Source package: [proxychains-ng]

    Details (2)

    • 4.16-2 · amd64 · bookworm

      Affected

      dsa · proxychains-ng · debian · bookworm; dsa · proxychains-ng · debian · 12

    • 4.16-2 · arm64 · bookworm

      Affected

      dsa · proxychains-ng · debian · bookworm; dsa · proxychains-ng · debian · 12

[Debian 13 (Trixie)]

  • [libproxychains4]Unknown

    Source package: [proxychains-ng]

    Details (2)

    • 4.17-3 · amd64 · trixie

      Affected

      dsa · proxychains-ng · debian · 13

    • 4.17-3 · arm64 · trixie

      Affected

      dsa · proxychains-ng · debian · 13

  • [proxychains4]Unknown

    Source package: [proxychains-ng]

    Details (2)

    • 4.17-3 · amd64 · trixie

      Affected

      dsa · proxychains-ng · debian · 13

    • 4.17-3 · arm64 · trixie

      Affected

      dsa · proxychains-ng · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]