Skip to content
OpenAdvisories
Critical RHSA-2024:0072 6 CVEs

Red Hat Security Advisory: squid security update

Published Sep 16, 2024 · Updated Jul 12, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream squid 7:5.5-5.el9_2.3
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream squid-debuginfo 7:5.5-5.el9_2.3
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream squid-debugsource 7:5.5-5.el9_2.3

Vulnerabilities 6

  • Critical 9.3
    CVE-2025-54574 Public exploit EPSS 22%

    Squid's URN Handling can lead to Buffer Overflow

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • High 8.6
    CVE-2023-46724

    SQUID-2023:4 Denial of Service in SSL Certificate validation

    Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49285 EPSS 88%

    Denial of Service in HTTP Message Processing in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49286 EPSS 10%

    Denial of Service in Helper Process management

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-46728

    SQUID-2021:8 Denial of Service in Gopher gateway

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid pr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-5824

    Squid: dos against http and https

    A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a l…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2245914
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2247567
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2248521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252923
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252926
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0072.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-5824
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-5824
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-5824
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255
  • report
    https://access.redhat.com/security/cve/CVE-2023-46724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-46724
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-46724
  • article
    http://www.squid-cache.org/Versions/v5/SQUID-2023_4.patch
  • article
    http://www.squid-cache.org/Versions/v6/SQUID-2023_4.patch
  • article
    https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-73m6-jm96-c6r3
  • report
    https://access.redhat.com/security/cve/CVE-2023-46728
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-46728
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-46728
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-cg5h-v6vc-w33f
  • article
    https://megamansec.github.io/Squid-Security-Audit/gopher-nullpointer.html
  • report
    https://access.redhat.com/security/cve/CVE-2023-49285
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49285
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49285
  • report
    https://access.redhat.com/security/cve/CVE-2023-49286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-49286
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-49286
  • report
    https://access.redhat.com/security/cve/CVE-2025-54574
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2386026
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-54574
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-54574
  • article
    https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
  • article
    https://github.com/squid-cache/squid/releases/tag/SQUID_6_4
  • article
    https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3