CVE-2024-25111

moderate-risk

Published 2024-03-06

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.

Do I need to act?

3.1% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.6/10 High

NETWORK / LOW complexity

Affected Products (4)

Squid

Fedora

Bluexp

Affected Vendors

Squid-Cache Fedoraproject Netapp

References (11)

Mailing List http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch

Vendor Advisory https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc

Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...

Third Party Advisory https://security.netapp.com/advisory/ntap-20240605-0001/

Mailing List http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch

Vendor Advisory https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc

https://lists.debian.org/debian-lts-announce/2025/03/msg00009.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...

Third Party Advisory https://security.netapp.com/advisory/ntap-20240605-0001/

/ 100

moderate-risk

Severity 29/34 · Critical

Exploitability 6/34 · Minimal

Exposure 10/34 · Low