[GH-ISSUE #2893] [Security] Dependency on a vulnerable version of go-proxyproto

gitea-mirror commented

2026-05-05 13:29:14 -06:00

Owner

Copy link

Originally created by @obormot on GitHub (Apr 14, 2022).
Original GitHub issue: https://github.com/fatedier/frp/issues/2893

Bug Description

https://github.com/fatedier/frp/blob/v0.41.0/go.mod#L19
has a pinned dependency on go-proxyproto v0.5.0

go-proxyproto before 0.6.0 is vulnerable to Denial of Service (DoS) via
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23409
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439

frp Version

release tag 0.41.0

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @obormot on GitHub (Apr 14, 2022). Original GitHub issue: https://github.com/fatedier/frp/issues/2893 ### Bug Description https://github.com/fatedier/frp/blob/v0.41.0/go.mod#L19 has a pinned dependency on go-proxyproto v0.5.0 go-proxyproto before 0.6.0 is vulnerable to Denial of Service (DoS) via https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23409 https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439 ### frp Version release tag 0.41.0 ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [X] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror closed this issue

2026-05-05 13:29:15 -06:00

gitea-mirror commented

2026-05-05 13:29:16 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (Apr 15, 2022):

This affected feature is not used in frp.

But it's ok to update to latest version. Thanks for you feedback.

@fatedier commented on GitHub (Apr 15, 2022): This affected feature is not used in frp. But it's ok to update to latest version. Thanks for you feedback.

gitea-mirror referenced this issue

2026-05-05 14:44:14 -06:00

[PR #2308] [MERGED] fix(server): listen udp port failed #4550

No Branch/Tag specified