Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libecap-develUpgrade squidUpgrade libecap | Oct 29, 2025 | Oct 27, 2025 |
| Alpine Linux | — | Upgrade squid | Dec 5, 2025 | Oct 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade squid-debuginfoUpgrade squidUpgrade squid-migration-scriptUpgrade squid-sysvinit | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade squid-debugsourceUpgrade squid-debuginfoUpgrade squid | Oct 28, 2025 | Oct 17, 2025 |
| Debian | — | Upgrade squid | Nov 4, 2025 | Nov 4, 2025 |
| Oracle_linux | — | Upgrade squid-sysvinitUpgrade squid-migration-scriptUpgrade libecapUpgrade libecap-develUpgrade squid | Oct 29, 2025 | Oct 17, 2025 |
| Redhat_linux | — | Upgrade libecapUpgrade libecap-debuginfoUpgrade libecap-debugsourceUpgrade squidUpgrade libecap-develUpgrade squid-migration-scriptUpgrade squid-sysvinitUpgrade squid-debugsourceUpgrade squid-debuginfoNo solution exists | Oct 29, 2025 | Oct 17, 2025 |
| Rocky_linux | — | Upgrade libecap-debuginfoUpgrade squid-debugsourceUpgrade libecap-debugsourceUpgrade squidUpgrade squid-debuginfoUpgrade libecapUpgrade libecap-devel | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade squid | Dec 5, 2025 | Oct 17, 2025 |
| Ubuntu | — | Upgrade squidUpgrade squid3 (Ubuntu Pro)Upgrade squid (Ubuntu Pro) | Oct 29, 2025 | Oct 21, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Oct 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub