Squid
ProductVulnerabilities
1 CVE in our records, 0 known exploited (on CISA's KEV list).
Source: NVD and CISA KEVAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Affected versions
- CVE-2023-5824 before 6.4 · fixed in 6.4
Security timeline
- Vulnerability reported by Ubuntu Security NoticesUbuntu notice USN-8998-1 covers a Squid flaw in HTTP Transfer-Encoding handling
- Security update reported by Debian Security AdvisoriesDebian issues squid security update fixing several proxy vulnerabilities
Recent news
Ubuntu notice USN-8998-1 covers a Squid flaw in HTTP Transfer-Encoding handling
Ubuntu's security notice USN-8998-1 describes a flaw in how Squid handles certain HTTP Transfer-Encoding headers. The article says an attacker could possibly use it for HTTP request smuggling, bypass security mechanisms, or poison web caches. The notice does not give a CVE ID or affected versions.
Debian issues squid security update fixing several proxy vulnerabilities
Debian Security Advisory DSA-6606-1 covers a squid package update addressing several security issues in the Squid caching proxy. The flaws could enable request smuggling, buffer overflows or FTP command injection under certain conditions. Administrators running Debian's squid package should apply the update.