Description
Squid 2.5.STABLE8 and earlier allows remote attackers to cause a denial of service (crash) via certain DNS responses regarding (1) Fully Qualified Domain Names (FQDN) in fqdncache.c or (2) IP addresses in ipcache.c, which trigger an assertion failure.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squid | 2.5.8-3 | — |
| Debian 13 | squid | 2.5.8-3 | — |
| Debian 12 | squid | 2.5.8-3 | — |
| Debian 3.0 | squid | 2.4.6-2woody7 | DSA-688-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | squid | 7:2.5.STABLE6-3.4E.5 | RHSA-2005:201 |
| RHEL 3 | squid | 7:2.5.STABLE3-6.3E.8 | RHSA-2005:173 |
Advisories 3
- RHSA-2005:201 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:173 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-688-1 squid - mising input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20050221 [USN-84-1] Squid vulnerabilities mailing-list
- GLSA-200502-25 vendor-advisory
- 14271 third-party-advisory
- squid-xstrndup-dos(19332) vdb-entry
- http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE8-dns_assert.patch
- RHSA-2005:201 vendor-advisory
- 12551 vdb-entry
- http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert
- FLSA-2006:152809 vendor-advisory
- DSA-688 vendor-advisory
- RHSA-2005:173 vendor-advisory
- oval:org.mitre.oval:def:11264 vdb-entry signature
- CLA-2005:931 vendor-advisory
- MDKSA-2005:047 vendor-advisory