CVE-2024-45802highCWE-20

CVE-2024-45802: high-severity vulnerability in squid-cache squid

Squid Denial of Service

Published · Updated

Follow this CVE+ Monitor squid+ Monitor squid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 48%
In short

Squid, a web caching proxy, can be crashed or become unavailable when a trusted server sends specially crafted requests, affecting all users relying on that proxy. This happens because Squid doesn't properly validate input and manage resources, allowing the server to trigger a denial of service.

Technical detail

A trusted upstream server can exploit input validation flaws and improper resource management (premature release during expected lifetime and missing release after effective lifetime) in Squid to trigger a denial of service condition affecting all downstream clients. The vulnerability requires a trusted server in the attack chain and is mitigated in Squid 6.10 default configuration.

Summary generated and translated by AI from the official description.
Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This bug is fixed in the default build configuration of Squid version 6.10.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
squid-cache · squid
Related CVEs — squid-cache squid

In the same product, most dangerous first.

CVE-2023-49285HIGHDenial of Service in HTTP Message Processing in SquidEPSS 88.1%CVE-2024-25617MEDIUMDenial of Service in HTTP Header parser in squid proxyEPSS 88.1%CVE-2024-25111HIGHSQUID-2024:1 Denial of Service in HTTP Chunked DecodingEPSS 65.3%CVE-2025-62168CRITICALSquid vulnerable to information disclosure via authentication credential leakage in error handlingEPSS 61.6%CVE-2024-23638MEDIUMSQUID-2023:11 Denial of Service in Cache ManagerEPSS 60.1%CVE-2023-50269HIGHSQUID-2023:10 Denial of Service in HTTP Request parsingEPSS 57.6%