Pypi · Go-Proxyproto · CVE-2021-23409
**Name of the Vulnerable Software and Affected Versions**
github.com/pires/go-proxyproto versions prior to 0.6.0
**Description**
The vulnerability in the github.com/pires/go-proxyproto library is related to the lack of a timeout when waiting for the proxy protocol header. This allows a remote attacker to cause a denial of service by creating connections without the proxy protocol header, leading to resource exhaustion. The issue can be exploited by opening many connections and sending no data on them.
**Recommendations**
For versions prior to 0.6.0, update to version 0.6.0 or later to resolve the issue. Additionally, consider configuring a user-defined header timeout to prevent similar issues in the future. As a temporary workaround, consider restricting access to the PROXY protocol server to minimize the risk of exploitation.