Description
An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Shadowsocks | Shadowsocks-libev 3.3.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | shadowsocks-libev | 3.3.3+ds-2 | — |
| Debian 12 | shadowsocks-libev | 3.3.3+ds-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | shadowsocks-libev | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | shadowsocks-libev | 3.3.3-bp151.5.3.1 | openSUSE-SU-2020:0142-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | shadowsocks-libev | 3.3.5-1.9 | openSUSE-SU-2024:11379-1 |
| openSUSE Leap 15.1 | shadowsocks-libev | 3.3.3-lp151.2.3.1 | openSUSE-SU-2019:2667-1 |
Advisories 3
- openSUSE-SU-2019:2667-1 Security update for shadowsocks-libev SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0142-1 Security update for shadowsocks-libev SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11379-1 libshadowsocks-libev2-3.3.5-1.9 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openSUSE-SU-2019:2667 vendor-advisory
- openSUSE-SU-2020:0142 vendor-advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0956