CVE-2023-49285
Denial of Service in HTTP Message Processing in Squid
- State
- Published
- Severity
- 8.6 High
- Published
- Dec 4, 2023
- Updated
- Feb 13, 2025
- Reserved
- Nov 24, 2023
Description
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | GitHub_M |
Weaknesses
- CWE-126 Buffer Over-read
Affected Products
| Product | Versions |
|---|---|
squidsquid-cache |
|
References
- https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9
- https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521b
- https://github.com/squid-cache/squid/commit/deee944f9a12c9fd399ce52f3e2526bb573a9470
- http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patch
- http://www.squid-cache.org/Versions/v6/SQUID-2023_7.patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
- https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
- https://security.netapp.com/advisory/ntap-20240119-0004/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.