Log in Start free

Vulnerability · Published Aug 1, 2025 · Assigned by GitHub_M

CVE-2025-54574Squid's URN Handling can lead to Buffer Overflow

Critical 9.3

In plain English

A critical-severity heap buffer overflow in squid from squid-cache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 22.1% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)22.1%top 2.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libecap1.0.1-2.module_el8.6.0+2741+01592ae8ALSA-2023:7668
AlmaLinux:8libecap1.0.1-2.module_el8.6.0+3048+383bc947ALSA-2023:7668
AlmaLinux:8libecap-devel1.0.1-2.module_el8.6.0+2741+01592ae8ALSA-2023:7668
AlmaLinux:8libecap-devel1.0.1-2.module_el8.6.0+3048+383bc947ALSA-2023:7668
AlmaLinux:8squid7:4.15-7.module_el8.9.0+3696+b881db49.3ALSA-2023:7668
Debian:12squid5.7-2+deb12u3DSA-5982-1
Debian:12squid5.7-2+deb12u3DEBIAN-CVE-2025-54574
Debian:13squid6.5-1DEBIAN-CVE-2025-54574
Debian:14squid6.5-1DEBIAN-CVE-2025-54574
Ubuntu:22.04:LTSsquid5.7-0ubuntu0.22.04.4UBUNTU-CVE-2025-54574

Affected products (as reported)

VendorProductVersions
squid-cache squid < 6.4

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

References