Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

v2ray/v2ray-core

              master @ d80440f
            

179

Fixes

CVEs

CRITICAL

Peak severity

26.3%

Coverage

Highlights

Denial of Service: 122 prior fixes. Scrutinize any change in this area.

proxy/shadowsocks: most-fixed (16 issues). Treat as high-risk during review.

73 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Time-drift validation can be bypassed in VMess AEAD verification if negative timestamps are not rejected or absolute time differentials are calculated incorrectly. Developers must reject negative timestamps before processing absolute differences.

Denial of Service: Integer overflow vulnerability in WebSocket frame length parsing allows attackers to bypass configured read limits, leading to remote Denial of Service.

Auth Bypass: A critical logical inversion in SOCKS5 authentication allowed users with incorrect or non-existent credentials to authenticate successfully while rejecting correct ones.