CVE-2024-23638
CVE-2024-23638 is a medium-severity vulnerability in Squid-cache Squid with a CVSS 3.x base score of 6.5. Its EPSS exploit-prediction score of 60% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-672.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- EPSS exploit prediction: 60% (99th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-21127
- Weakness: CWE-672
- Affected product: Squid-cache Squid
- Published:
- Last modified:
Description
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
Frequently asked questions
- What is CVE-2024-23638?
- Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
- How severe is CVE-2024-23638?
- CVE-2024-23638 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2024-23638 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 60% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-23638?
- CVE-2024-23638 affects Squid-cache Squid. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-23638?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-23638 have an EU (EUVD) identifier?
- Yes. CVE-2024-23638 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-21127.
- When was CVE-2024-23638 published?
- CVE-2024-23638 was published on 2024-01-24 and last updated on 2026-06-17.
References
- http://www.squid-cache.org/Versions/v5/SQUID-2023_11.patch
- http://www.squid-cache.org/Versions/v6/SQUID-2023_11.patch
- https://github.com/squid-cache/squid/commit/290ae202883ac28a48867079c2fb34c40efd382b
- https://github.com/squid-cache/squid/commit/e8118a7381213f5cfcdeb4cec1d2d854bfd261c8
- https://github.com/squid-cache/squid/security/advisories/GHSA-j49p-553x-48rx
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/
- https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
- https://security.netapp.com/advisory/ntap-20240208-0010/
Affected products (1)
- cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
More vulnerabilities in Squid-cache Squid
- CVE-2025-62168 — Critical (CVSS 10.0): Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication…
- CVE-2020-15049 — Critical (CVSS 9.9): An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request…
- CVE-2020-11945 — Critical (CVSS 9.8): An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to…
- CVE-2019-12519 — Critical (CVSS 9.8): An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls…
- CVE-2019-12524 — Critical (CVSS 9.8): An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the…
- CVE-2019-12526 — Critical (CVSS 9.8): An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow.…
All CVEs affecting Squid-cache Squid →
Other CWE-672 (Operation on a Resource after Expiration or Release) vulnerabilities
- CVE-2023-41094 — Critical (CVSS 10.0): TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing…
- CVE-2020-24030 — Critical (CVSS 9.8): ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and…
- CVE-2020-12043 — Critical (CVSS 9.8): The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP…
- CVE-2019-17638 — Critical (CVSS 9.4): In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an…
- CVE-2013-10075 — Critical (CVSS 9.1): Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores…
- CVE-2022-22755 — High (CVSS 8.8): By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute…
Browse all CWE-672 (Operation on a Resource after Expiration or Release) vulnerabilities →
Threat intelligence
Threat-intel indicators referencing this CVE:
- 78.39.48.166 (ipv4-addr)
- 212.58.132.5 (ipv4-addr)
- 103.200.23.154 (ipv4-addr)
- 103.54.101.248 (ipv4-addr)
- 74.113.233.217 (ipv4-addr)