CVE-2019-14243

Published 23 Jul 2019 · Updated 05 Aug 2024

Follow this CVE + Monitor github.com/mastercactapus/proxyprotocol

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 4.3%

headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.

Affected products

n/a · n/a

References

https://caddy.community/t/dos-in-http-proxyprotocol-plugin/6014 https://github.com/mastercactapus/caddy-proxyprotocol/issues/8 https://github.com/mastercactapus/proxyprotocol/commit/5c4a101121fc3e868026189c7a73f7f19eef90ac https://github.com/mastercactapus/proxyprotocol/compare/ef496d7...5c4a101 https://github.com/mastercactapus/proxyprotocol/issues/1 https://github.com/mastercactapus/proxyprotocol/releases/tag/v0.0.2