Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-libecapalma-upgrade-libecap-develalma-upgrade-squid | Apr 15, 2024 | Dec 14, 2023 | |
| Alpine Linux | alpine-linux-upgrade-squid | Mar 26, 2024 | Dec 14, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-squidamazon-linux-ami-2-upgrade-squid-debuginfoamazon-linux-ami-2-upgrade-squid-migration-scriptamazon-linux-ami-2-upgrade-squid-sysvinit | Feb 8, 2024 | Dec 14, 2023 | |
| Amazon_linux | — | amazon-linux-upgrade-squid | Feb 6, 2024 | Dec 14, 2023 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-squidamazon-linux-2023-upgrade-squid-debuginfoamazon-linux-2023-upgrade-squid-debugsource | Feb 17, 2025 | Dec 14, 2023 | |
| Centos_linux | — | centos-upgrade-squidcentos-upgrade-squid-debuginfocentos-upgrade-squid-migration-scriptcentos-upgrade-squid-sysvinit | Apr 12, 2024 | Dec 14, 2023 |
| Debian | debian-upgrade-squid | Jan 15, 2024 | Dec 14, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-squid | Mar 13, 2024 | Dec 14, 2023 | |
| Oracle_linux | oracle-linux-upgrade-libecaporacle-linux-upgrade-libecap-develoracle-linux-upgrade-squidoracle-linux-upgrade-squid-migration-scriptoracle-linux-upgrade-squid-sysvinit | Mar 21, 2024 | Dec 14, 2023 | |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-libecapredhat-upgrade-libecap-debuginforedhat-upgrade-libecap-debugsourceredhat-upgrade-libecap-develredhat-upgrade-squidredhat-upgrade-squid-debuginforedhat-upgrade-squid-debugsourceredhat-upgrade-squid-migration-scriptredhat-upgrade-squid-sysvinit | Jan 26, 2024 | Dec 14, 2023 | |
| Rocky_linux | rocky-upgrade-libecaprocky-upgrade-libecap-debuginforocky-upgrade-libecap-debugsourcerocky-upgrade-libecap-devel | May 8, 2025 | Dec 14, 2023 | |
| Suse | — | suse-upgrade-squid | Feb 2, 2024 | Dec 14, 2023 |
| Ubuntu | ubuntu-pro-upgrade-squidubuntu-pro-upgrade-squid3ubuntu-upgrade-squid | Jan 24, 2024 | Dec 14, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Dec 14, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub