CVE-2024-37894: medium-severity vulnerability in squid-cache squid
Squid vulnerable to heap corruption in ESI assign
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Squid, a web caching tool, has a flaw in how it handles ESI variables that can overwrite memory it shouldn't touch. An attacker can exploit this to crash the service or cause it to malfunction.
An out-of-bounds write vulnerability exists in Squid's ESI (Edge Side Includes) variable assignment mechanism, allowing an attacker to corrupt heap memory. Exploitation requires crafted ESI content processing; the vulnerability can result in denial of service through application crash or undefined behavior.
In the same product, most dangerous first.