CVE-2025-31135

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is considered part of the exchange between client and server, so the client is free to send further PROXY commands with whatever data it pleases. go-guerrilla will treat these as coming from the reverse proxy, allowing a client to spoof its IP address. This vulnerability is fixed in 1.6.7.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-311365.4FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This ocCVE-2025-311377.5React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React RouterCVE-2025-311386.6tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where userCVE-2025-311396.5In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build logCVE-2025-31149.4Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate securiCVE-2025-311406.1In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles pageCVE-2025-311417.5In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles pageCVE-2025-311446.9Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, aCVE-2025-311466.1Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3:CVE-2025-311475.3Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-31159.8Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. AdditCVE-2025-31166.5CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special