Skip to content
OpenAdvisories
Critical USN-7845-1 1 CVE

squid, squid3 vulnerability

Published Oct 28, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Leonardo Giovannini discovered that Squid failed to redact HTTP
Authentication credentials in a default configuration. An attacker could
possibly use this issue to obtain sensitive information.

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS squid 5.9-0ubuntu0.22.04.4
Ubuntu · 24.04 LTS 24.04:LTS squid 6.13-0ubuntu0.24.04.3
Ubuntu · 25.10 squid 6.13-1ubuntu4.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS squid3 3.5.12-1ubuntu7.16+esm5
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS squid3 3.5.27-1ubuntu1.14+esm4
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS squid 4.10-1ubuntu1.13+esm1

Vulnerabilities 1

  • Critical 10.0
    CVE-2025-62168 Public exploit Scanner template EPSS 62%

    Squid vulnerable to information disclosure via authentication credential leakage in error handling

    Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the c…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2025-62168