Skip to content
OpenAdvisories
High ALSA-2024:1375 3 CVEs

Important: squid:4 security update

Published Mar 19, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

* squid: denial of service in HTTP header parser (CVE-2024-25617)
* squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)
* squid: denial of service in HTTP request parsing (CVE-2023-50269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 5

ReleasePackageFixed in
AlmaLinux · 8 libecap 1.0.1-2.module_el8.6.0+2741+01592ae8
AlmaLinux · 8 libecap 1.0.1-2.module_el8.6.0+3048+383bc947
AlmaLinux · 8 libecap-devel 1.0.1-2.module_el8.6.0+2741+01592ae8
AlmaLinux · 8 libecap-devel 1.0.1-2.module_el8.6.0+3048+383bc947
AlmaLinux · 8 squid 7:4.15-7.module_el8.9.0+3749+dbf371ed.10

Vulnerabilities 3

  • High 8.6
    CVE-2023-50269 EPSS 58%

    SQUID-2023:10 Denial of Service in HTTP Request parsing

    Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This …

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2024-25111 EPSS 65%

    SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

    Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of …

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2024-25617 EPSS 89%

    Denial of Service in HTTP Header parser in squid proxy

    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-50269
  • report
    https://access.redhat.com/security/cve/CVE-2024-25111
  • report
    https://access.redhat.com/security/cve/CVE-2024-25617
  • report
    https://bugzilla.redhat.com/2254663
  • report
    https://bugzilla.redhat.com/2264309
  • report
    https://bugzilla.redhat.com/2268366
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-1375.html