CVE-2024-37894
Squid vulnerable to heap corruption in ESI assign
In short
Squid, a web caching tool, has a flaw in how it handles ESI variables that can overwrite memory it shouldn't touch. An attacker can exploit this to crash the service or cause it to malfunction.
Technical detail
An out-of-bounds write vulnerability exists in Squid's ESI (Edge Side Includes) variable assignment mechanism, allowing an attacker to corrupt heap memory. Exploitation requires crafted ESI content processing; the vulnerability can result in denial of service through application crash or undefined behavior.
Summary generated and translated by AI from the official description.
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Affected products
squid-cache · squidWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →