Vulnerability · Published Oct 17, 2025 · Assigned by GitHub_M
CVE-2025-62168Squid vulnerable to information disclosure via authentication credential leakage in error handling
Critical 10.0
In plain English
A critical-severity security flaw in squid from squid-cache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 64.8% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libecap | 1.0.1-2.module_el8.6.0+3048+383bc947 | ALSA-2025:19107 |
| AlmaLinux:8 | libecap | 1.0.1-2.module_el8.6.0+2741+01592ae8 | ALSA-2025:19107 |
| AlmaLinux:8 | libecap-devel | 1.0.1-2.module_el8.6.0+2741+01592ae8 | ALSA-2025:19107 |
| AlmaLinux:8 | libecap-devel | 1.0.1-2.module_el8.6.0+3048+383bc947 | ALSA-2025:19107 |
| AlmaLinux:10 | squid | 7:6.10-6.el10_1.1 | ALSA-2025:21002 |
| AlmaLinux:8 | squid | 7:4.15-10.module_el8.10.0+4055+645078d8.9 | ALSA-2025:19107 |
| AlmaLinux:9 | squid | 7:5.5-22.el9_7.1 | ALSA-2025:20935 |
| Alpine:v3.23 | squid | 7.3-r0 | ALPINE-CVE-2025-62168 |
| Alpine:v3.24 | squid | 7.3-r0 | ALPINE-CVE-2025-62168 |
| Debian:12 | squid | 5.7-2+deb12u4 | DSA-6047-1 |
| Debian:12 | squid | 5.7-2+deb12u4 | DEBIAN-CVE-2025-62168 |
| Debian:13 | squid | 6.13-2+deb13u1 | DSA-6047-1 |
| Debian:13 | squid | 6.13-2+deb13u1 | DEBIAN-CVE-2025-62168 |
| Debian:14 | squid | 7.2-1 | DEBIAN-CVE-2025-62168 |
| Rocky Linux:8 | libecap | 0:1.0.1-2.module+el8.9.0+1437+df5ea8f0 | RLSA-2025:19107 |
| Rocky Linux:10 | squid | 7:6.10-6.el10_1.1 | RLSA-2025:21002 |
| Rocky Linux:8 | squid | 7:4.15-10.module+el8.10.0+2080+49064dbd.9 | RLSA-2025:19107 |
| Rocky Linux:9 | squid | 7:5.5-22.el9_7.1 | RLSA-2025:20935 |
| Ubuntu:22.04:LTS | squid | 5.9-0ubuntu0.22.04.4 | UBUNTU-CVE-2025-62168 |
| Ubuntu:22.04:LTS | squid | 5.9-0ubuntu0.22.04.4 | USN-7845-1 |
| Ubuntu:24.04:LTS | squid | 6.13-0ubuntu0.24.04.3 | USN-7845-1 |
| Ubuntu:24.04:LTS | squid | 6.13-0ubuntu0.24.04.3 | UBUNTU-CVE-2025-62168 |
| Ubuntu:25.10 | squid | 6.13-1ubuntu4.1 | UBUNTU-CVE-2025-62168 |
| Ubuntu:25.10 | squid | 6.13-1ubuntu4.1 | USN-7845-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| squid-cache | squid | < 7.2 |
Weakness: CWE-209, CWE-550 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N