Description
Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (segmentation fault) by aborting the connection during a (1) PUT or (2) POST request, which causes Squid to access previously freed memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squid | 2.5.8 | — |
| Debian 13 | squid | 2.5.8 | — |
| Debian 12 | squid | 2.5.8 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | squid | 7:2.5.STABLE6-3.4E.9 | RHSA-2005:415 |
| RHEL 3 | squid | 7:2.5.STABLE3-6.3E.13 | RHSA-2005:415 |
Advisories 1
- RHSA-2005:415 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://www.squid-cache.org/bugs/show_bug.cgi?id=1224
- http://www1.uk.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post
- oval:org.mitre.oval:def:11562 vdb-entry signature
- squid-put-post-dos(19919) vdb-entry
- 13166 vdb-entry
- FLSA-2006:152809 vendor-advisory
- 12508 third-party-advisory
- RHSA-2005:489 vendor-advisory
- USN-111-1 vendor-advisory
- CLA-2005:931 vendor-advisory
- RHSA-2005:415 vendor-advisory