Privoxy is a widely deployed open-source filtering proxy used to enhance privacy and security in web browsing, occupying a prominent position in proxy and content-filtering deployments despite its narrow product scope. The vendor's vulnerability profile concentrates in memory-safety and input-handling weaknesses endemic to a network-facing C codebase: memory leaks and premature releases, input-validation gaps, buffer-boundary violations, and NULL-pointer dereferences recur across disclosures. These weakness classes reflect the parsing demands of HTTP traffic processing and the low-level memory management required in a proxy intercepting and transforming network streams. Defenders should treat Privoxy instances as critical infrastructure within their filtering layer and prioritize patching, especially where the proxy is internet-reachable or processes untrusted content; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Privoxy over time
Signals from CVEs in this vendor scope (29 CVEs).
29 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-2503MEDIUM Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to | Mar 11, 2013 | 5.8 | 33 | NO | YES |
CVE-2021-44542HIGH A memory leak vulnerability was found in Privoxy when handling errors. | Dec 23, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-44541HIGH A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination. | Dec 23, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-44540HIGH A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing. | Dec 23, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-20217HIGH A flaw was found in Privoxy in versions before 3.0.31. An assertion failure triggered by a crafted CGI request may lead to denial of service. The highest threat from this vulnerabi | Mar 25, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-20216HIGH A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly may lead to a denial of service. The highest threat from this | Mar 25, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-20215HIGH A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocations fail can lead to a system crash. | Mar 25, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-20214HIGH A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail can lead to a system | Mar 25, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-20213HIGH A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get | Mar 25, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-20212HIGH A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is skipped due to a pcre error leading to a system crash. | Mar 25, 2021 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (29 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Privoxy.
Media articles that mention a CVE ID that affects a product developed by Privoxy — matched by CVE ID, not by vendor name.