CVE-2021-23409: Denial of Service (DoS) in go-proxyproto
Summary
CVE-2021-23409: github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion. Affects github.com/pires/go-proxyproto versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Also tracked for
- golang-github-pires-go-proxyproto · Debian:11
The same CVE-2021-23409 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-proxyproto is a Go package that provides support for the PROXY protocol, allowing applications to receive the original client's IP address and port when behind a load balancer or reverse proxy. It is commonly used in network applications to ensure accurate logging and security measures. However, versions prior to 0.6.1 are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in go-proxyproto (versions before 0.6.1) arises from a flaw in connection descriptor handling. An attacker can exploit this by creating connections without the proxy protocol header, leading to resource exhaustion. Although an initial fix was introduced in version 0.6.0, it inadvertently introduced additional issues, which were subsequently patched in version 0.6.1. The impact of this vulnerability can result in service disruption and unavailability.
How To Fix
Latest published version: v0.16.0 as of 22 Oct 2026
go get github.com/pires/go-proxyproto@v0.16.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.1
This is the first release that contains the fix.
go get github.com/pires/go-proxyproto@v0.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by implementing rate limiting or connection throttling mechanisms to mitigate the risk of resource exhaustion. However, this is not a permanent solution and should be considered as a temporary measure until the package can be updated.
Conclusion
The vulnerability in go-proxyproto can be mitigated by upgrading to version 0.6.1 or later. It is crucial to promptly address this issue to prevent potential Denial of Service attacks and ensure the availability and stability of the affected applications. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pires/go-proxyproto →
FAQ
go-proxyproto is a Go package that enables applications to receive the original client's IP address and port when behind a load balancer or reverse proxy.
This vulnerability can lead to Denial of Service (DoS) attacks, causing service disruption and unavailability.
Versions prior to 0.6.1 are affected by this vulnerability.
Yes, the vulnerability has been patched in version 0.6.1 of go-proxyproto.
If upgrading is not immediately feasible, consider implementing rate limiting or connection throttling mechanisms as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pires/go-proxyproto.
