{"action":"Upgrade github.com/phires/go-guerrilla to 1.6.7 or later.","affected":[{"fixed":"1.6.7","introduced":"0"}],"component":"github.com/phires/go-guerrilla","cve_ids":["CVE-2025-31135"],"ecosystem":"Go","epss":0.00386,"exploited":false,"fixed_versions":["1.6.7"],"ghsa_id":"GHSA-c2c3-pqw5-5p7c","id":"tcs_01M5KF6F0PSN4GJJA4GX7H1PCJ","modified_at":"2026-06-08T16:00:10.310411354Z","published_at":"2025-04-01T22:23:49Z","references":["https://osv.dev/vulnerability/GHSA-c2c3-pqw5-5p7c","https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c","https://nvd.nist.gov/vuln/detail/CVE-2025-31135","https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6","https://github.com/phires/go-guerrilla","https://pkg.go.dev/vuln/GO-2025-3588"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-c2c3-pqw5-5p7c","url":"https://osv.dev/vulnerability/GHSA-c2c3-pqw5-5p7c"}],"summary":"Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times"}