CVE-2020-25219

Name of the Vulnerable Software and Affected Versions libproxy versions 0.4.x through 0.4.15

Description The issue is related to the url::recvline function in the url.cpp component of the libproxy library, which incorrectly handles the absence of a newline character. This can lead to uncontrolled recursion when a remote HTTP server sends a response composed of an infinite stream lacking a newline character, resulting in stack exhaustion. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For libproxy versions 0.4.x through 0.4.15, consider disabling the url::recvline function in the url.cpp component as a temporary workaround to prevent exploitation until a patch is available. Restrict access to the url.cpp component to minimize the risk of exploitation. Avoid using the url::recvline function in the affected libproxy versions until the issue is resolved.