CVE-2024-23638

CVE-2024-23638 is a medium-severity vulnerability in Squid-cache Squid with a CVSS 3.x base score of 6.5. Its EPSS exploit-prediction score of 60% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-672.

Key facts

Description

Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.

Frequently asked questions

What is CVE-2024-23638?
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
How severe is CVE-2024-23638?
CVE-2024-23638 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-23638 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 60% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-23638?
CVE-2024-23638 affects Squid-cache Squid. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-23638?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-23638 have an EU (EUVD) identifier?
Yes. CVE-2024-23638 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-21127.
When was CVE-2024-23638 published?
CVE-2024-23638 was published on 2024-01-24 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Squid-cache Squid

All CVEs affecting Squid-cache Squid →

Other CWE-672 (Operation on a Resource after Expiration or Release) vulnerabilities

Browse all CWE-672 (Operation on a Resource after Expiration or Release) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE: