{"cve":"CVE-2025-31135","nvd":{"published":"2025-04-01T22:15:21.437","modified":"2026-06-17T09:09:55.100","status":"Deferred","description":"Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is considered part of the exchange between client and server, so the client is free to send further PROXY commands with whatever data it pleases. go-guerrilla will treat these as coming from the reverse proxy, allowing a client to spoof its IP address. This vulnerability is fixed in 1.6.7.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3},"cwes":["CWE-20"],"references":["https://github.com/phires/go-guerrilla/commit/d08fe22f8022d2bdedc136f9e4ba96f2fbbebf18","https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:00:57.946988208+00:00"},"epss":{"cve":"CVE-2025-31135","score":0.00386,"percentile":0.3266,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-c2c3-pqw5-5p7c","url":"https://osv.dev/vulnerability/GHSA-c2c3-pqw5-5p7c","summary":"Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times","modified":"2026-06-08T16:00:10.310411354Z","packages":[{"ecosystem":"Go","name":"github.com/phires/go-guerrilla","purl":"pkg:golang/github.com/phires/go-guerrilla","ranges":["<1.6.7"],"fixed":["1.6.7"]}]},{"id":"GO-2025-3588","url":"https://osv.dev/vulnerability/GO-2025-3588","summary":"Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla","modified":"2026-03-03T04:56:28.541527Z","packages":[{"ecosystem":"Go","name":"github.com/phires/go-guerrilla","purl":"pkg:golang/github.com/phires/go-guerrilla","ranges":["<1.6.7"],"fixed":["1.6.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}