Vulnerability · Published Jul 30, 2025 · Assigned by GitHub_M

CVE-2025-54581vproxy is vulnerable to a divide by zero DoS attack

High 7.5

In plain English

A high-severity security flaw in vproxy from 0x676e67. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.

Affected products (as reported)

Vendor	Product	Versions
0x676e67	vproxy	< 2.4.0

Weakness: CWE-369 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/0x676e67/vproxy/security/advisories/GHSA-7h24-c332-p48c x_refsource_CONFIRM
https://github.com/0x676e67/vproxy/commit/aa1bf64c5e7f1c471395f9f29175ffc1b16a1079 x_refsource_MISC
https://github.com/0x676e67/vproxy/releases/tag/v2.4.0 x_refsource_MISC