CVE-2023-46724highCWE-125CWE-1285CWE-129CWE-786CWE-823

CVE-2023-46724: high-severity vulnerability in squid-cache squid

SQUID-2023:4 Denial of Service in SSL Certificate validation

Published · Updated

Follow this CVE+ Monitor squid+ Monitor squid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 2.8%
In short

Squid proxy is vulnerable to crashes when processing specially crafted SSL certificates during HTTPS connections. A remote server can exploit this to disable the proxy service.

Technical detail

Improper index validation in Squid's OpenSSL-compiled versions (3.3.0.1–5.9, 6.0–6.3) allows remote attackers to trigger denial of service by sending a malformed SSL certificate chain during TLS handshake. The attack vector requires HTTPS or SSL-Bump mode; exploitation results in proxy crash or unavailability.

Summary generated and translated by AI from the official description.
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected products
squid-cache · squid
Related CVEs — squid-cache squid

In the same product, most dangerous first.

CVE-2023-49285HIGHDenial of Service in HTTP Message Processing in SquidEPSS 88.1%CVE-2024-25617MEDIUMDenial of Service in HTTP Header parser in squid proxyEPSS 88.1%CVE-2024-25111HIGHSQUID-2024:1 Denial of Service in HTTP Chunked DecodingEPSS 65.3%CVE-2025-62168CRITICALSquid vulnerable to information disclosure via authentication credential leakage in error handlingEPSS 64.8%CVE-2024-23638MEDIUMSQUID-2023:11 Denial of Service in Cache ManagerEPSS 60.1%CVE-2023-50269HIGHSQUID-2023:10 Denial of Service in HTTP Request parsingEPSS 57.6%