Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libecap-develUpgrade squidUpgrade libecap | Oct 29, 2025 | Oct 27, 2025 |
| Alpine Linux | — | Upgrade squid | Dec 5, 2025 | Oct 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade squid-sysvinitUpgrade squid-migration-scriptUpgrade squidUpgrade squid-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade squid-debugsourceUpgrade squid-debuginfoUpgrade squid | Oct 28, 2025 | Oct 17, 2025 |
| Debian | — | Upgrade squid | Nov 4, 2025 | Nov 4, 2025 |
| Oracle_linux | — | Upgrade squid-migration-scriptUpgrade libecapUpgrade squid-sysvinitUpgrade libecap-develUpgrade squid | Oct 29, 2025 | Oct 17, 2025 |
| Redhat_linux | — | Upgrade squid-debugsourceUpgrade squid-debuginfoUpgrade squid-sysvinitNo solution existsUpgrade squid-migration-scriptUpgrade libecap-develUpgrade libecap-debugsourceUpgrade libecapUpgrade libecap-debuginfoUpgrade squid | Oct 29, 2025 | Oct 17, 2025 |
| Rocky_linux | — | Upgrade squidUpgrade squid-debuginfoUpgrade libecapUpgrade libecap-develUpgrade libecap-debugsourceUpgrade squid-debugsourceUpgrade libecap-debuginfo | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade squid | Dec 5, 2025 | Oct 17, 2025 |
| Ubuntu | — | Upgrade squid (Ubuntu Pro)Upgrade squid3 (Ubuntu Pro)Upgrade squid | Oct 29, 2025 | Oct 21, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Oct 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub