CVE-2024-25111: high-severity vulnerability in squid-cache squid
SQUID-2024:1 Denial of Service in HTTP Chunked Decoding
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Squid web proxy versions 3.5.27 to 6.7 are vulnerable to a denial of service attack when processing specially crafted HTTP messages with chunked encoding. An attacker can crash the proxy by sending a malicious request that triggers uncontrolled recursion in the decoder.
CVE-2024-25111 exploits an uncontrolled recursion vulnerability in Squid's HTTP chunked transfer encoding decoder (CWE-674). A remote attacker can send a crafted chunked-encoded HTTP message to trigger recursive calls without proper depth limits, causing memory exhaustion and denial of service. Affected versions are 3.5.27 through 6.7; the issue is fixed in version 6.8.
In the same product, most dangerous first.