Netty SOCKS Proxy Credential Leak over HTTP (CVE-2025-85713)

Vulnerability Summary: SOCKS Proxy Credentials Leaked to Origin Server via Plaintext HTTP Overview Title: SOCKS proxy credentials sent to the origin server over plaintext HTTP Severity: High (CVSS 3.1 Score: 7.5/10) CVE ID: CVE-2025-85713 Description: When a SOCKS proxy is configured with proxy authentication, the client appends the header for the SOCKS proxy to requests sent to the origin server. Because the SOCKS request is tunneled directly to the origin server without passing through the proxy, the header is sent along with the request, causing the proxy credentials to be leaked to the origin server over a plaintext HTTP connection. Impact: The origin server can obtain the proxy credentials and may issue a challenge to the client using a 407 response, potentially obtaining credentials for NTLM, Kerberos, and SPNEGO schemes. Scope Affected Versions: - 3.x series: - 2.x series: Not Affected: Versions prior to 2.1.0 in the 2.x series (as they do not support SOCKS proxy) Resolution Fixed Versions: - 3.x line: Fixed in 3.0.12 - 2.x line: Fixed in 2.16.1 Workarounds: - Unaffected if proxy authentication is not configured - Restricting requests to HTTPS is not an effective workaround, as the challenge path applies equally Technical Details Root Cause: The gateway and its companion class in did not check the proxy type, erroneously writing the header onto requests destined for the origin server. Related Separate Issue: GHSA-rqf5-2h9v-d4 (plaintext password transmission under Basic authentication); upgrading to 3.0.13 is recommended to resolve both issues.

Goal Reached Thanks to every supporter — we hit 100%!

Netty SOCKS Proxy Credential Leak over HTTP (CVE-2025-85713)

More from this source