High severity · published Mar 6, 2024
CVE-2024-25111
Squid is a web proxy cache
7.5
CVSS
65.3%
EPSS
No
On KEV
Description
Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)65.3% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Bluexp · Netapp
All versions, or not specified · source: NVD
FE
Fedora · Fedoraproject
38; 39 · source: NVD
SQ
Squid · Squid-cache
3.5.27 before 6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-25111
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-25111
Mailing List
http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch
Vendor Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240605-0001/
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/03/msg00009.html
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)