CVE-2025-31135: Go-Guerrilla SMTP IP Spoofing Vulnerability

CVE-2025-31135 Overview

CVE-2025-31135 affects Go-Guerrilla SMTP Daemon, a lightweight SMTP server written in Go. Versions prior to 1.6.7 accept multiple PROXY commands when ProxyOn is enabled, allowing later invocations to override earlier ones. The PROXY protocol specification only supports one initial PROXY header at the start of the connection. Any subsequent data is meant to be part of the client-server exchange. Go-Guerrilla incorrectly treats these later PROXY commands as authoritative reverse proxy input, enabling a client to spoof its source IP address. The issue is tracked under [CWE-20] (Improper Input Validation) and resolved in version 1.6.7.

Critical Impact
Attackers can spoof source IP addresses to bypass IP-based access controls, evade rate limiting, and poison audit logs used for abuse tracking and reputation systems.

Affected Products

Go-Guerrilla SMTP Daemon versions prior to 1.6.7
Deployments with ProxyOn configuration enabled
Applications embedding go-guerrilla as an SMTP library behind a reverse proxy

Discovery Timeline

2025-04-01 - CVE CVE-2025-31135 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31135

Vulnerability Analysis

The PROXY protocol, developed by HAProxy, transmits original client connection information from a reverse proxy to a backend server. The specification mandates exactly one PROXY header at the beginning of the TCP connection. Everything after that first header belongs to the application protocol layer, such as SMTP commands.

Go-Guerrilla's state machine does not enforce this constraint. When ProxyOn is enabled, the server continues to process PROXY commands throughout the SMTP session. Each new PROXY command overwrites the previously stored client IP address, effectively allowing the SMTP client itself to declare its remote address.

An attacker connecting to a legitimate reverse proxy can inject a second PROXY line inside the SMTP dialog and rewrite the recorded source IP. This defeats IP-based allowlists, geo-blocking, abuse throttling, and forensic attribution.

Root Cause

The root cause is an incomplete client state machine. The original code exposed a single ClientGreeting state and reused PROXY parsing logic across subsequent inputs. The patch introduces distinct ClientConnected and ClientProxy states, ensuring PROXY header parsing occurs exactly once before the SMTP greeting is emitted.

Attack Vector

Exploitation requires network access to a go-guerrilla SMTP server running behind a reverse proxy with ProxyOn enabled. No authentication or user interaction is required. The attacker issues a second PROXY TCP4 <spoofed_ip> <server_ip> <sport> <dport> line at any point after the initial handshake to overwrite the recorded source IP.

 type ClientState int
 
 const (
-	// The client has connected, and is awaiting our first response
-	ClientGreeting = iota
+	// The client has connected
+	ClientConnected = iota
+	// We're awaiting a PROXY header from the client
+	ClientProxy
+	// The client is awaiting our first response
+	ClientGreeting
 	// We have responded to the client's connection and are awaiting a command
 	ClientCmd
 	// We have received the sender and recipient information

Source: GitHub Commit d08fe22 — The patch adds explicit ClientConnected and ClientProxy states so PROXY parsing is bounded to the pre-greeting phase of the connection.

Detection Methods for CVE-2025-31135

Indicators of Compromise

Multiple PROXY protocol lines observed within a single SMTP session in packet captures or proxy logs.
Discrepancies between the source IP recorded by go-guerrilla and the source IP recorded by the upstream reverse proxy for the same connection.
SMTP sessions where the client-recorded remote address changes mid-session in application logs.

Detection Strategies

Inspect SMTP traffic for the literal string PROXY appearing after the initial TCP handshake bytes, using network monitoring tools or IDS signatures.
Correlate reverse proxy access logs with go-guerrilla connection logs to identify mismatched source IPs for the same connection ID.
Audit go-guerrilla server versions across the fleet and flag any instance below 1.6.7 with ProxyOn set to true.

Monitoring Recommendations

Enable verbose connection logging on both the reverse proxy and go-guerrilla to preserve original and reported IP addresses.
Alert on SMTP connections that assert unexpected private-range or loopback IP addresses via PROXY headers.
Track abuse metrics that depend on client IP reputation to detect anomalous shifts caused by spoofing.

How to Mitigate CVE-2025-31135

Immediate Actions Required

Upgrade go-guerrilla to version 1.6.7 or later across all deployments.
Inventory applications and Go modules depending on github.com/phires/go-guerrilla to identify vulnerable embeddings.
If immediate upgrade is not possible, set ProxyOn to false and rely on network-layer controls to preserve client identity.

Patch Information

The fix is committed in GitHub Commit d08fe22 and documented in the GitHub Security Advisory GHSA-c2c3-pqw5-5p7c. The patch restructures the client state machine to accept PROXY headers only during the new ClientProxy state, before the SMTP greeting.

Workarounds

Disable ProxyOn in the go-guerrilla configuration if the deployment does not require PROXY protocol support.
Terminate PROXY protocol at a trusted upstream layer and forward plain SMTP to go-guerrilla, discarding embedded PROXY lines.
Enforce IP-based access controls at the reverse proxy layer rather than relying on the address reported by go-guerrilla.

bash

# Update go-guerrilla dependency to patched version
go get github.com/phires/go-guerrilla@v1.6.7
go mod tidy

# Verify installed version
go list -m github.com/phires/go-guerrilla