CVE-2025-54574
Squid's URN Handling can lead to Buffer Overflow
- State
- Published
- Severity
- 9.3 Critical
- Published
- Aug 1, 2025
- Updated
- Nov 5, 2025
- Reserved
- Jul 25, 2025
Description
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.3 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H | GitHub_M |
Weaknesses
- CWE-122 Heap-based Buffer Overflow
Affected Products
| Product | Versions |
|---|---|
squidsquid-cache |
|
References
- https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3
- https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
- https://github.com/squid-cache/squid/releases/tag/SQUID_6_4
- https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html
- http://www.openwall.com/lists/oss-security/2025/11/05/5
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.