CVE-2013-10005: socks Infinite Loop vulnerability in github.com/btcsuite/go-socks
Summary
CVE-2013-10005: socks Infinite Loop vulnerability. Affects github.com/btcsuite/go-socks versions < 0.0.0-20130808000456-233bccbb1abe. Fixed in 0.0.0-20130808000456-233bccbb1abe. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/btcsuite/go-socks package is a Go implementation of the SOCKS protocol. It provides functionality for creating SOCKS servers and clients, allowing applications to communicate over the SOCKS proxy. The package is widely used in Go applications that require SOCKS proxy support.
Vulnerability Detail
The vulnerability identified as CVE-2013-10005 is an Infinite Loop vulnerability in the RemoteAddr and LocalAddr methods of the net.Conn returned by the github.com/btcsuite/go-socks package. When these methods are called, they may inadvertently call themselves, resulting in an infinite loop. This can lead to a stack overflow and crash the program. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: v0.0.0-20170105172521-4720035b7bfd as of 23 Oct 2026
go get github.com/btcsuite/go-socks@v0.0.0-20170105172521-4720035b7bfdUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20130808000456-233bccbb1abe
This is the first release that contains the fix.
go get github.com/btcsuite/go-socks@v0.0.0-20130808000456-233bccbb1abeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the package to a fixed version.
Conclusion
The socks Infinite Loop vulnerability in the github.com/btcsuite/go-socks package can lead to a stack overflow and program crash. It is recommended to update the package to a fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/btcsuite/go-socks →
FAQ
The vulnerability can cause a stack overflow and crash the program, leading to a denial-of-service condition. An attacker may be able to exploit this vulnerability to disrupt the functionality of affected applications.
To determine if your application is affected, you can use the Vulert Playground at Vulert Scanner. Simply upload your Gopkg.lock file to check if your application is using a vulnerable version of the github.com/btcsuite/go-socks package.
There are no known public exploits for this vulnerability at the time of this report. However, it is recommended to apply the fix as soon as possible to mitigate the risk.
No, there is no known workaround for this vulnerability. It is necessary to update the package to a fixed version.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gxgj-xjcw-fv9p/GHSA-gxgj-xjcw-fv9p.json.
