Skip to content
OpenAdvisories
Critical RHSA-2023:7465 3 CVEs

Red Hat Security Advisory: squid security update

Published Sep 16, 2024 · Updated Jul 12, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream squid 7:5.5-6.el9_3.2
Red Hat · RHEL 9 enterprise_linux:9::appstream squid-debuginfo 7:5.5-6.el9_3.2
Red Hat · RHEL 9 enterprise_linux:9::appstream squid-debugsource 7:5.5-6.el9_3.2

Vulnerabilities 3

  • Critical 9.3
    CVE-2025-54574 Public exploit EPSS 22%

    Squid's URN Handling can lead to Buffer Overflow

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • High 8.6
    CVE-2023-49288

    Denial of Service in HTTP Collapsed Forwarding in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and includ…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-5824

    Squid: dos against http and https

    A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a l…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2245914
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7465.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-5824
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-5824
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-5824
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255
  • report
    https://access.redhat.com/security/cve/CVE-2023-49288
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252918
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49288
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49288
  • report
    https://access.redhat.com/security/cve/CVE-2025-54574
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2386026
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-54574
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-54574
  • article
    https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
  • article
    https://github.com/squid-cache/squid/releases/tag/SQUID_6_4
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3