Log in Start free

Vulnerability · Published Dec 14, 2023 · Assigned by GitHub_M

CVE-2023-50269SQUID-2023:10 Denial of Service in HTTP Request parsing

High 8.6

In plain English

A high-severity security flaw in squid from squid-cache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 57.6% (higher than 99.1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)57.6%top 0.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libecap1.0.1-2.module_el8.6.0+3048+383bc947ALSA-2024:1375
AlmaLinux:8libecap1.0.1-2.module_el8.6.0+2741+01592ae8ALSA-2024:1375
AlmaLinux:8libecap-devel1.0.1-2.module_el8.6.0+3048+383bc947ALSA-2024:1375
AlmaLinux:8libecap-devel1.0.1-2.module_el8.6.0+2741+01592ae8ALSA-2024:1375
AlmaLinux:8squid7:4.15-7.module_el8.9.0+3749+dbf371ed.10ALSA-2024:1375
AlmaLinux:9squid7:5.5-6.el9_3.8ALSA-2024:1376
Alpine:v3.20squid6.6-r0ALPINE-CVE-2023-50269
Alpine:v3.21squid6.6-r0ALPINE-CVE-2023-50269
Alpine:v3.22squid6.6-r0ALPINE-CVE-2023-50269
Alpine:v3.23squid6.6-r0ALPINE-CVE-2023-50269
Alpine:v3.24squid6.6-r0ALPINE-CVE-2023-50269
Debian:12squid5.7-2+deb12u1DSA-5637-1
Debian:12squid5.7-2+deb12u1DEBIAN-CVE-2023-50269
Debian:13squid6.6-1DEBIAN-CVE-2023-50269
Debian:14squid6.6-1DEBIAN-CVE-2023-50269
Rocky Linux:8libecap0:1.0.1-2.module+el8.9.0+1437+df5ea8f0RLSA-2024:1375
Ubuntu:22.04:LTSsquid5.7-0ubuntu0.22.04.3USN-6594-1
Ubuntu:22.04:LTSsquid5.7-0ubuntu0.22.04.3UBUNTU-CVE-2023-50269
Ubuntu:24.04:LTSsquid6.5-1ubuntu3UBUNTU-CVE-2023-50269

Affected products (as reported)

VendorProductVersions
squid-cache squid >= 2.6, <= 2.7.STABLE9>= 3.1, <= 5.9>= 6.0.1, < 6.6

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

References