Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libecapUpgrade squidUpgrade libecap-devel | Oct 29, 2025 | Oct 27, 2025 |
| Alpine Linux | — | Upgrade squid | Dec 5, 2025 | Oct 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade squid-sysvinitUpgrade squidUpgrade squid-migration-scriptUpgrade squid-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade squid-debugsourceUpgrade squidUpgrade squid-debuginfo | Oct 28, 2025 | Oct 17, 2025 |
| Debian | — | Upgrade squid | Nov 4, 2025 | Nov 4, 2025 |
| Oracle_linux | — | Upgrade squid-migration-scriptUpgrade squid-sysvinitUpgrade libecapUpgrade squidUpgrade libecap-devel | Oct 29, 2025 | Oct 17, 2025 |
| Redhat_linux | — | Upgrade libecap-develUpgrade libecap-debuginfoUpgrade libecapUpgrade squidUpgrade libecap-debugsourceUpgrade squid-migration-scriptUpgrade squid-debugsourceUpgrade squid-debuginfoUpgrade squid-sysvinitNo solution exists | Oct 29, 2025 | Oct 17, 2025 |
| Rocky_linux | — | Upgrade squid-debugsourceUpgrade libecap-debuginfoUpgrade libecapUpgrade squid-debuginfoUpgrade squidUpgrade libecap-debugsourceUpgrade libecap-devel | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade squid | Dec 5, 2025 | Oct 17, 2025 |
| Ubuntu | — | Upgrade squidUpgrade squid (Ubuntu Pro)Upgrade squid3 (Ubuntu Pro) | Oct 29, 2025 | Oct 21, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Oct 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub