CVE-2025-54581: vproxy Divide by Zero DoS Vulnerability
Summary
CVE-2025-54581: vproxy Divide by Zero DoS Vulnerability. Affects vproxy versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vproxy is an open-source HTTP proxy server designed to facilitate network communication by forwarding requests and responses between clients and servers. It is built using Rust and is known for its performance and efficiency. However, like many software packages, it is susceptible to vulnerabilities that can compromise its stability and security. This specific vulnerability allows an attacker to exploit the server's handling of user-controlled data, leading to a denial of service.
Vulnerability Detail
The vulnerability arises from the handling of untrusted data extracted from the HTTP Proxy-Authorization header. When an attacker supplies a TTL (Time to Live) value of zero, a division by zero panic occurs during the modulo operation 'timestamp % ttl'. This results in the server crashing, rendering it unusable until it is manually reset. The code responsible for this vulnerability can be found in the vproxy source code, specifically in the parse_ttl_extension function.
How To Fix
Latest published version: 2.5.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-controlled data in the HTTP Proxy-Authorization header that could lead to a TTL of zero. Ensure that any usernames or values passed do not include 'ttl-0' or similar patterns that could trigger the vulnerability.
Conclusion
The CVE-2025-54581 vulnerability in vproxy poses a significant risk by allowing attackers to induce a denial of service through a divide by zero error. It is crucial to update to the patched version 2.4.0 or later to mitigate this risk. Additionally, implementing proper data validation can help prevent similar vulnerabilities in the future.
See every vulnerability recorded for vproxy →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If your server crashes, it will become unusable until it is manually reset. This can lead to downtime and affect users relying on the proxy service.
Yes, by ensuring that user-controlled data is validated and sanitized before being processed, you can prevent the exploitation of this vulnerability.
You can find more information about the vproxy package on its GitHub repository or its official documentation.
