CVE-2025-34451

Name	CVE-2025-34451
Description	rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflow vulnerability in the function proxy_from_string() located in src/libproxychains.c. When parsing crafted proxy configuration entries containing overly long username or password fields, the application may write beyond the bounds of fixed-size stack buffers, leading to memory corruption or crashes. This vulnerability may allow denial of service and, under certain conditions, could be leveraged for further exploitation depending on the execution environment and applied mitigations.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1123676

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
proxychains-ng (PTS)	bullseye	4.14-3	vulnerable
	bookworm	4.16-2	vulnerable
	forky, sid, trixie	4.17-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
proxychains-ng	source	(unstable)	(unfixed)			1123676

Notes

[trixie] - proxychains-ng <no-dsa> (Minor issue)
[bookworm] - proxychains-ng <no-dsa> (Minor issue)
[bullseye] - proxychains-ng <postponed> (Minor issue)
https://github.com/rofl0r/proxychains-ng/issues/606
https://github.com/httpsgithu/proxychains-ng/commit/cc005b7132811c9149e77b5e33cff359fc95512e