High · published December 19, 2025
🚨 A single malformed IGMPv3 packet is all it takes to crash your igmpproxy! This vulnerability could leave your devices vulnerable to denial-of-service attacks. ⚡ Think of igmpproxy like a crowded restaurant handling multicast orders: if a delivery driver shows up with a wrong order, the kitchen can get overwhelmed and shut down altogether. That's what happens when malformed multicast traffic hits the igmpproxy! An attacker could send specially crafted packets to your network, causing igmpproxy to crash. This could lead to disruption in your streaming services, leaving your home network in chaos and your favorite shows unreachable!
Think of igmpproxy like a crowded restaurant handling multicast orders: if a delivery driver shows up with a wrong order, the kitchen can get overwhelmed and shut down altogether. That's what happens when malformed multicast traffic hits the igmpproxy! The vulnerability arises from insufficient validation in the `recv_igmp()` function of igmpproxy’s source code. Specifically, an invalid group record type can trigger a NULL pointer dereference during logging, leading to an application crash.
An attacker could send specially crafted packets to your network, causing igmpproxy to crash. This could lead to disruption in your streaming services, leaving your home network in chaos and your favorite shows unreachable! Update igmpproxy to the latest version to patch this vulnerability and ensure secure handling of IGMP packets. Additionally, consider implementing network rules to filter out malformed multicast traffic. You've got this! By taking these steps, you'll strengthen your network and keep those pesky attackers at bay. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| pali/igmpproxy | all versions | — |