{"action":"Upgrade github.com/phires/go-guerrilla to 1.6.7 or later.","affected":[{"fixed":"1.6.7","introduced":"0"}],"component":"github.com/phires/go-guerrilla","cve_ids":["CVE-2025-31135"],"ecosystem":"Go","epss":0.00382,"exploited":false,"fixed_versions":["1.6.7"],"ghsa_id":"GHSA-c2c3-pqw5-5p7c","id":"tcs_01M5KG7W79FXY4RJGKAZZT1PX6","modified_at":"2026-03-03T04:56:28.541527Z","published_at":"2025-04-02T16:02:03Z","references":["https://osv.dev/vulnerability/GO-2025-3588","https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c","https://nvd.nist.gov/vuln/detail/CVE-2025-31135","https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GO-2025-3588","url":"https://osv.dev/vulnerability/GO-2025-3588"},{"source":"nvd","source_id":"CVE-2025-31135","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31135"}],"summary":"Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla"}