SQUID-2024:1 Denial of Service in HTTP Chunked Decoding (squid-cache squid)
At a glance
- Source
- NVD
- EPSS
- EPSS 65.25 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.
Weaknesses (CWE)
- CWE-674 — Uncontrolled Recursion
References
- https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc
- http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/
- https://security.netapp.com/advisory/ntap-20240605-0001/
- https://lists.debian.org/debian-lts-announce/2025/03/msg00009.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | GitHub_M |
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-22472
- GCVE · GCVE-0-2024-25111
CERT-FR advisories
- CERTFR-2024-AVI-0182 — Vulnérabilité dans les produits Squid · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*≥ 3.5.27 < 6.8cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| squid-cache · squid | affected >= 3.5.27, < 6.8 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |