CVE catalog

CVE-2025-50681

igmpproxy affected and fixed versions

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service (application crash) via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the `recv_igmp()` function in src/igmpproxy.c, an invalid group record type can trigger a NULL pointer dereference when logging the address using `inet_fmtsrc()`. This vulnerability can be exploited by sending malformed multicast traffic to a host running igmpproxy, leading to a crash. igmpproxy is used in various embedded networking environments and consumer-grade IoT devices (such as home routers and media gateways) to handle multicast traffic for IPTV and other streaming services. Affected devices that rely on unpatched versions of igmpproxy may be vulnerable to remote denial-of-service attacks across a LAN .

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Dec 19, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.52% · Oct 27, 2026

Projects and upstream resources

[igmpproxy][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	igmpproxy	`0.3-2`	FixedDistribution-reported fixed boundary	[CVE-2025-50681]

Showing 1 fix observations. All 15 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	igmpproxy	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	igmpproxy	Not reported	AffectedDistribution reports no fix	[CVE-2025-50681]
Debianbookworm	igmpproxy	`0.3-1`	Affected	[CVE-2025-50681]
Debiansid	igmpproxy	`0.3-2`	FixedDistribution-reported fixed boundary	[CVE-2025-50681]
Debiantrixie	igmpproxy	Not reported	AffectedDistribution reports no fix	[CVE-2025-50681]
Debiantrixie	igmpproxy	`0.3-1`	Affected	[CVE-2025-50681]
Ubuntu18.04	igmpproxy	`0.1-1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC
Ubuntu18.04	igmpproxy	`0.2-1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC
Ubuntu18.04	igmpproxy	`0.2.1-1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC
Ubuntu20.04	igmpproxy	`0.2.1-1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC
Ubuntu22.04	igmpproxy	`0.3-1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC
Ubuntu24.04	igmpproxy	`0.3-1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC
Ubuntu25.10	igmpproxy	`0.3-1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC
Ubuntu26.04	igmpproxy	`0.3-1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC
Ubuntu26.04	igmpproxy	`0.3-1build1`	Affected	[UBUNTU-CVE-2025-50681]May 20, 2026, 4:23:33 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "igmpproxy",
      "status": "fixed",
      "release": "sid",
      "version": "0.3-2"
    },
    {
      "name": "igmpproxy",
      "status": "vulnerable",
      "release": "trixie",
      "version": "0.3-1"
    },
    {
      "name": "igmpproxy",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "0.3-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1123741,
      "name": "igmpproxy",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "0.3-2"
    },
    {
      "bug": 1123741,
      "name": "igmpproxy",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1123741,
      "name": "igmpproxy",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "igmpproxy",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "igmpproxy",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50681",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2025-50681",
      "provider_updated_at": "2026-10-13T11:10:00.203"
    },
    {
      "name": "igmpproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "0.1-1",
        "0.2-1",
        "0.2.1-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-50681",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2025-50681",
      "provider_updated_at": "2026-05-20T16:23:33.448702913Z"
    },
    {
      "name": "igmpproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "0.2.1-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-50681",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2025-50681",
      "provider_updated_at": "2026-05-20T16:23:33.448702913Z"
    },
    {
      "name": "igmpproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "0.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-50681",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2025-50681",
      "provider_updated_at": "2026-05-20T16:23:33.448702913Z"
    },
    {
      "name": "igmpproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "0.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-50681",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2025-50681",
      "provider_updated_at": "2026-05-20T16:23:33.448702913Z"
    },
    {
      "name": "igmpproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "0.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-50681",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2025-50681",
      "provider_updated_at": "2026-05-20T16:23:33.448702913Z"
    },
    {
      "name": "igmpproxy",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "0.3-1",
        "0.3-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-50681",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2025-50681",
      "provider_updated_at": "2026-05-20T16:23:33.448702913Z"
    }
  ]
}

[Debian bug #1123741]

Publisher notes

[trixie] igmpproxy: Minor issue [bookworm] igmpproxy: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[igmpproxy]Unknown
Details (2)
- 0.3-1 · amd64 · bookworm
  Affected
  dsa · igmpproxy · debian · bookworm
- 0.3-1 · arm64 · bookworm
  Affected
  dsa · igmpproxy · debian · bookworm

Observed: Oct 24, 2026, 7:59:43 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]