CVE-2023-43644

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
SagerNet	sing-box	< 1.4.5; >= 1.5.0-beta.1, < 1.5.0-rc.4
sagernet	sing-box	< 1.5.0-rc.5

References

https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285gVendor Advisory
https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285gVendor Advisory

Timeline

Published: Sep 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-436455.9OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of ser CVE-2023-436467.5get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 ar CVE-2023-436475.4baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload featur CVE-2023-436486.5baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission dat CVE-2023-436499.8baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content prev CVE-2023-43654.3Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a CVE-2023-436507.4JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to t CVE-2023-436519.9JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary comman CVE-2023-436529.1JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an CVE-2023-436549.8TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, e CVE-2023-436558.8Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be CVE-2023-436569.0matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transfo