Libproxy · Libproxy · CVE-2020-26154
**Name of the Vulnerable Software and Affected Versions**
libproxy versions prior to 0.4.16
**Description**
The issue is related to a buffer overflow in the url.cpp file of libproxy when PAC is enabled. This can be triggered by a large PAC file delivered without a Content-length header, potentially allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.
**Recommendations**
For versions prior to 0.4.16, update to version 0.4.16 or later to resolve the issue.
As a temporary workaround, consider disabling PAC when using libproxy until a patch is available.
Restrict access to the url.cpp component to minimize the risk of exploitation.