How severe is CVE-2025-62168?

CVE-2025-62168 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2025-62168 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 63% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-62168?

CVE-2025-62168 affects Squid-cache Squid. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-62168?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-62168 have an EU (EUVD) identifier?

Yes. CVE-2025-62168 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34894.

When was CVE-2025-62168 published?

CVE-2025-62168 was published on 2025-10-17 and last updated on 2026-06-17.

CVE-2025-62168

CVE-2025-62168 is a critical-severity vulnerability in Squid-cache Squid with a CVSS 3.x base score of 10.0. Its EPSS exploit-prediction score of 63% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-209.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
EPSS exploit prediction: 63% (99th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-34894
Weakness: CWE-209
Affected product: Squid-cache Squid
Published: 2025-10-17
Last modified: 2026-06-17

Description

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.

Frequently asked questions

What is CVE-2025-62168?: Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
How severe is CVE-2025-62168?: CVE-2025-62168 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2025-62168 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 63% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-62168?: CVE-2025-62168 affects Squid-cache Squid. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-62168?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-62168 have an EU (EUVD) identifier?: Yes. CVE-2025-62168 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34894.
When was CVE-2025-62168 published?: CVE-2025-62168 was published on 2025-10-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

More vulnerabilities in Squid-cache Squid

CVE-2020-15049 — Critical (CVSS 9.9): An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request…
CVE-2020-11945 — Critical (CVSS 9.8): An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to…
CVE-2019-12519 — Critical (CVSS 9.8): An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls…
CVE-2019-12524 — Critical (CVSS 9.8): An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the…
CVE-2019-12526 — Critical (CVSS 9.8): An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow.…
CVE-2019-12525 — Critical (CVSS 9.8): An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest…

All CVEs affecting Squid-cache Squid →

Other CWE-209 (Generation of Error Message Containing Sensitive Information) vulnerabilities

CVE-2025-68110 — Critical (CVSS 9.9): ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an…
CVE-2025-46658 — Critical (CVSS 9.8): An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages.
CVE-2024-28285 — Critical (CVSS 9.8): A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows…
CVE-2023-40767 — Critical (CVSS 9.8): User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where…
CVE-2023-40766 — Critical (CVSS 9.8): User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery,…
CVE-2023-40765 — Critical (CVSS 9.8): User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where…

Browse all CWE-209 (Generation of Error Message Containing Sensitive Information) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

78.39.48.166 (ipv4-addr)
212.58.132.5 (ipv4-addr)
103.200.23.154 (ipv4-addr)
38.248.6.103 (ipv4-addr)
200.89.159.59 (ipv4-addr)
103.54.101.248 (ipv4-addr)
74.113.233.217 (ipv4-addr)
192.3.127.40 (ipv4-addr)