CVE-2023-43644

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.

• CWE-306

• https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285gVendor Advisory
• https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285gVendor Advisory

Published

Sep 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43637 Due to the implementation of "deriveVaultKey", prior to ver…7.8
• CVE-2023-4364Inappropriate implementation in Permission Prompts in Google…4.3
• CVE-2023-43640TaxonWorks is a web-based workbench designed for taxonomists…6.5
• CVE-2023-43641libcue provides an API for parsing and extracting data from …8.8
• CVE-2023-43642snappy-java is a Java port of the snappy, a fast C++ compres…7.5
• CVE-2023-43643AntiSamy is a library for performing fast, configurable clea…6.1
• CVE-2023-43645OpenFGA is an authorization/permission engine built for deve…5.9
• CVE-2023-43646get-func-name is a module to retrieve a function's name secu…7.5
• CVE-2023-43647baserCMS is a website development framework. Prior to versio…5.4
• CVE-2023-43648baserCMS is a website development framework. Prior to versio…6.5
• CVE-2023-43649baserCMS is a website development framework. Prior to versio…9.8
• CVE-2023-4365Inappropriate implementation in Fullscreen in Google Chrome …4.3