Description
The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squid | 2.6.18-1 | — |
| Debian 13 | squid | 2.6.18-1 | — |
| Debian 12 | squid | 2.6.18-1 | — |
| Debian 4.0 | squid | 2.6.5-6etch4 | DSA-1646-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | squid | 7:2.6.STABLE6-5.el5_1.3 | RHSA-2008:0214 |
| RHEL 4 | squid | 7:2.5.STABLE14-1.4E.el4_6.2 | RHSA-2008:0214 |
| RHEL 3 | squid | 7:2.5.STABLE3-9.3E | RHSA-2008:0214 |
| RHEL 2 | squid | 7:2.4.STABLE7-1.21as.12 | RHSA-2008:0214 |
Advisories 2
- RHSA-2008:0214 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1646-2 squid - array bounds check Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-601-1 vendor-advisory
- FEDORA-2008-2740 vendor-advisory
- 28693 vdb-entry
- 29813 third-party-advisory
- SUSE-SR:2008:011 vendor-advisory
- 30032 third-party-advisory
- DSA-1646 vendor-advisory
- GLSA-200903-38 vendor-advisory
- 27477 third-party-advisory
- squid-arrayshrink-dos(41586) vdb-entry
- MDVSA-2008:134 vendor-advisory
- 32109 third-party-advisory
- http://www.squid-cache.org/Advisories/SQUID-2007_2.txt
- RHSA-2008:0214 vendor-advisory
- http://www.squid-cache.org/Versions/v2/2.6/changesets/11882.patch
- [squid-announce[ 20080322 Advisory Squid-2007:2 updated mailing-list
- oval:org.mitre.oval:def:11376 vdb-entry signature
- 34467 third-party-advisory
- [oss-security] 20080401 CVE id request: squid mailing-list