Vulnerabilities in pkg:golang/github.com/phires/go-guerrilla

PACKAGE
Advisory Identifier: GHSA-c2c3-pqw5-5p7c
Share
Advisory Summary

CVE-2025-31135 is a MODERATE (CVSS 5.3) go-guerrilla smtp daemon allows the vulnerability (CWE-20: Improper Input Validation) affecting Github.com/phires/go guerrilla libraries in the Go ecosystem. The issue involves go-guerrilla smtp daemon allows the proxy command to be sent multiple times. Remediation is available by upgrading affected packages to version 1.6.7.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:golang/github.com/phires/go-guerrilla

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:golang/github.com/phires/go-guerrilla. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-c2c3-pqw5-5p7c CVE-2025-31135 MODERATE Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times

CVE-2025-31135 at a Glance

CVE Identifier CVE-2025-31135
GHSA Identifier GHSA-c2c3-pqw5-5p7c
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-20: Improper Input Validation
Affected Product Github.com/phires/go guerrilla
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2025-31135

To remediate this vulnerability, upgrade all affected Github.com/phires/go guerrilla dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/phires/go-guerrilla fixed: 1.6.7 
Upgrade github.com/phires/go-guerrilla to 1.6.7
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/phires/go-guerrilla

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-31135, inspect your project dependencies for Github.com/phires/go guerrilla:

inspect dependencies for github.com/phires/go-guerrilla

Analyze the terminal output to locate any version of Github.com/phires/go guerrilla in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.6.7), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Github.com/phires/go guerrilla, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The PROXY command is accepted multiple times, allowing a client to spoof its IP address when the proxy protocol is being used. ### Details When ProxyOn is enabled, [it looks like the PROXY command will be accepted multiple times](https://github.com/phires/go-guerrilla/blob/fca3b2d8957a746997c7e71fca39004f5c96e91f/server.go#L495), with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is considered part of the exchange between client and server, so the client is free to send further PROXY commands with whatever data it pleases. go-guerrilla will treat these as coming from the reverse proxy, allowing a client to spoof its IP address. Note that the format of the PROXY header is [well-defined](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt). It probably shouldn't be treated as an SMTP command; parsing it the same way is likely to result in odd behavior and could lead to other vulnerabilities. ### PoC I'm working on writing a PR to fix this vulnerability. It'll include a unit test that will serve as a PoC on the current version. ### Impact Any instance with `ProxyOn` enabled (`proxyon` in the JSON config) is affected. As far as I'm able to tell, the impact is limited to spoofing the `RemoteIP` field. This isn't ideal, but it probably has less practical impact on an MTA than, say, a web server.

CVE-2025-31135 Affected Github.com/phires/go guerrilla Versions

1 component(s)
Fixed Versions:
1.6.7
Product / Package Ecosystem Affected Versions Fixed Version
github.com/phires/go-guerrilla
golang/github.com/phires/go-guerrilla
Go
< 1.6.7
1.6.7

References

GitHub Advisory / Wiki ADVISORY
https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c
NVD — CVE-2025-31135 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31135
Security Fix Commit FIX COMMIT
https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6
Github.com/phires/go guerrilla Source Repository REPOSITORY
https://github.com/phires/go-guerrilla
pkg.go.dev/vuln/go-2025-3588 WEB
https://pkg.go.dev/vuln/GO-2025-3588

Frequently Asked Questions

What is CVE-2025-31135?
CVE-2025-31135 is a security vulnerability in Github.com/phires/go guerrilla involving Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times under CWE-20: Improper Input Validation.
Which Github.com/phires/go guerrilla versions are affected?
Affected versions include releases prior to 1.6.7 across affected packages: github.com/phires/go-guerrilla.
What version fixes CVE-2025-31135?
Upgrading to 1.6.7 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/phires/go-guerrilla affected?
Yes, github.com/phires/go-guerrilla is affected in releases prior to 1.6.7. Upgrade your dependency to 1.6.7 or later.
What is the CVSS score of CVE-2025-31135?
CVE-2025-31135 has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
What CWE is associated with CVE-2025-31135?
CVE-2025-31135 is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).
How can I check Go dependencies for CVE-2025-31135?
Run the dependency tree command: 'inspect dependencies for github.com/phires/go-guerrilla'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c2c3-pqw5-5p7c",
  "modified" : "2026-06-08T15:57:50Z",
  "published" : "2025-04-01T22:23:49Z",
  "aliases" : [ "CVE-2025-31135" ],
  "summary" : "Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times",
  "details" : "### Summary\n\nThe PROXY command is accepted multiple times, allowing a client to spoof its IP address when the proxy protocol is being used.\n\n### Details\n\nWhen ProxyOn is enabled, [it looks like the PROXY command will be accepted multiple times](https://github.com/phires/go-guerrilla/blob/fca3b2d8957a746997c7e71fca39004f5c96e91f/server.go#L495), with later invocations overriding earlier ones.  The proxy protocol only supports one initial PROXY header; anything after that is considered part of the exchange between client and server, so the client is free to send further PROXY commands with whatever data it pleases.  go-guerrilla will treat these as coming from the reverse proxy, allowing a client to spoof its IP address.\n\nNote that the format of the PROXY header is [well-defined](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt).  It probably shouldn't be treated as an SMTP command; parsing it the same way is likely to result in odd behavior and could lead to other vulnerabilities.\n\n### PoC\n\nI'm working on writing a PR to fix this vulnerability.  It'll include a unit test that will serve as a PoC on the current version.\n\n### Impact\n\nAny instance with `ProxyOn` enabled (`proxyon` in the JSON config) is affected.\n\nAs far as I'm able to tell, the impact is limited to spoofing the `RemoteIP` field.  This isn't ideal, but it probably has less practical impact on an MTA than, say, a web server.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/phires/go-guerrilla"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.6.7"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-31135"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/phires/go-guerrilla"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2025-3588"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-04-01T22:23:49Z",
    "nvd_published_at" : "2025-04-01T22:15:21Z"
  }
}