Skip to content
OpenAdvisories
High USN-6857-1 6 CVEs

squid3 vulnerabilities

Published Jun 27, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Joshua Rogers discovered that Squid incorrectly handled requests with the
urn: scheme. A remote attacker could possibly use this issue to cause
Squid to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS. (CVE-2021-28651)

It was discovered that Squid incorrectly handled SSPI and SMB
authentication. A remote attacker could use this issue to cause Squid to
crash, resulting in a denial of service, or possibly obtain sensitive
information. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-41318)

Joshua Rogers discovered that Squid incorrectly handled HTTP message
processing. A remote attacker could possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2023-49285)

Joshua Rogers discovered that Squid incorrectly handled Helper process
management. A remote attacker could possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2023-49286)

Joshua Rogers discovered that Squid incorrectly handled HTTP request
parsing. A remote attacker could possibly use this issue to cause
Squid to crash, resulting in a denial of service.
(CVE-2023-50269, CVE-2024-25617)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS squid3 3.5.12-1ubuntu7.16+esm3
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS squid3 3.5.27-1ubuntu1.14+esm2

Vulnerabilities 6

  • High 8.6
    CVE-2022-41318

    A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection…

    squid squid3 squid squid Debian Ubuntu Alpine
  • High 8.6
    CVE-2023-49285 EPSS 88%

    Denial of Service in HTTP Message Processing in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgr…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-49286 EPSS 10%

    Denial of Service in Helper Process management

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5.…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 8.6
    CVE-2023-50269 EPSS 58%

    SQUID-2023:10 Denial of Service in HTTP Request parsing

    Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This …

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2024-25617 EPSS 88%

    Denial of Service in HTTP Header parser in squid proxy

    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-28651

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial o…

    squid squid3 squid squid Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2021-28651
  • report
    https://ubuntu.com/security/CVE-2022-41318
  • report
    https://ubuntu.com/security/CVE-2023-49285
  • report
    https://ubuntu.com/security/CVE-2023-49286
  • report
    https://ubuntu.com/security/CVE-2023-50269
  • report
    https://ubuntu.com/security/CVE-2024-25617