CVE-2025-54574criticalCWE-122

CVE-2025-54574: critical vulnerability in squid-cache squid

Squid's URN Handling can lead to Buffer Overflow

Published · Updated

Follow this CVE+ Monitor squid+ Monitor squid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

53Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.3epss 22%
from disclosure to weapon4 days
Published on NVDAug 1
1st PoC+4d
In short

Squid, a web caching proxy, has a critical flaw in how it handles URN requests that can cause a heap buffer overflow, potentially allowing attackers to execute malicious code remotely on vulnerable systems.

Technical detail

A heap buffer overflow exists in Squid versions ≤6.3 during URN processing due to improper buffer management. Remote attackers can trigger this vulnerability by sending specially crafted URN requests, potentially achieving remote code execution without authentication. The vulnerability is fixed in version 6.4.

Summary generated and translated by AI from the official description.
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
Affected products
squid-cache · squid
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — squid-cache squid

In the same product, most dangerous first.

CVE-2023-49285HIGHDenial of Service in HTTP Message Processing in SquidEPSS 88.1%CVE-2024-25617MEDIUMDenial of Service in HTTP Header parser in squid proxyEPSS 88.1%CVE-2024-25111HIGHSQUID-2024:1 Denial of Service in HTTP Chunked DecodingEPSS 65.3%CVE-2025-62168CRITICALSquid vulnerable to information disclosure via authentication credential leakage in error handlingEPSS 64.8%CVE-2024-23638MEDIUMSQUID-2023:11 Denial of Service in Cache ManagerEPSS 60.1%CVE-2023-50269HIGHSQUID-2023:10 Denial of Service in HTTP Request parsingEPSS 57.6%