CVE-2023-46848
Squid: denial of service in ftp
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Squid: denial of service in ftp
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
CVE-2023-46848- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-681
- Updated
- 2026-11-02
EUVDEUVD-2023-51014
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
EUVD-2023-51014- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
CVE-2023-46848- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-681
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-46848
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
ALPINE-CVE-2023-46848- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-110525
CVE-2023-46848 affecting package squid 6.13-5
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
AZL-110525- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-31903
CVE-2023-46848 affecting package squid 5.7-5
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
AZL-31903- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 18 moreShow less
OSV
Squid: denial of service in ftp
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
CVE-2023-46848- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-681
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-46848
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
DEBIAN-CVE-2023-46848- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:6266
Red Hat Security Advisory: squid security update
- Record
RHSA-2023:6266- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2023:6268
Red Hat Security Advisory: squid security update
- Record
RHSA-2023:6268- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2023:6748
Red Hat Security Advisory: squid security update
- Record
RHSA-2023:6748- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-46848
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- Record
UBUNTU-CVE-2023-46848- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2023:6266 No score
Critical: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
Security Fix(es):
- SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)
- SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)
- SQUID-2023:5 squid: denial of Service in FTP (CVE-2023-46848)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:6266- Updated
- 2026-11-02
OSVALSA-2023:6748 No score
Critical: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
Security Fix(es):
- squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)
- squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)
- squid: denial of Service in FTP (CVE-2023-46848)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:6748- Updated
- 2026-11-02
OSVCLSA-2023-1700161280 No score
squid: Fix of 3 CVEs
- CVE-2023-46846: Improve HTTP chunked encoding compliance
- CVE-2023-46847: Fix stack buffer overflow when parsing Digest Authorization
- CVE-2023-46848: Fix userinfo percent-encoding
- Record
CLSA-2023-1700161280- Updated
- 2026-11-02
OSVCLSA-2026-1775643576 No score
squid: Fix of CVE-2023-46848
- CVE-2023-46848: fix userinfo percent-encoding
- Record
CLSA-2026-1775643576- Updated
- 2026-11-02
OSVMGASA-2023-0315 No score
Updated squid packages fix security vulnerabilities
The updated packages fix security vulnerabilities:
Request/Response smuggling in HTTP/1.1 and ICAP. (CVE-2023-46846)
Denial of Service in HTTP Digest Authentication. (CVE-2023-46847)
Denial of Service in FTP. (CVE-2023-46848)
- Record
MGASA-2023-0315- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13398-1 No score
squid-6.4-1.1 on GA media
These are all security issues fixed in the squid-6.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13398-1- Updated
- 2026-11-02
OSVRLSA-2023:6266 No score
Critical: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
Security Fix(es):
-
SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)
-
SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)
-
SQUID-2023:5 squid: denial of Service in FTP (CVE-2023-46848)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2023:6266- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-318-CVE-2023-46848 No score
CVE-2023-46848 in squid - Patched by Root
Root has patched CVE-2023-46848 in the squid package for Root:Alpine:3.18. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-318-CVE-2023-46848- Updated
- 2026-11-02
OSVSUSE-SU-2023:4380-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2023-46846: Request/Response smuggling in HTTP/1.1 and ICAP (bsc#1216500).
- CVE-2023-46847: Denial of Service in HTTP Digest Authentication (bsc#1216495).
- CVE-2023-46724: Fix validation of certificates with CN=* (bsc#1216803).
- CVE-2023-46848: Denial of Service in FTP (bsc#1216498).
- Record
SUSE-SU-2023:4380-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4381-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2023-46846: Request/Response smuggling in HTTP/1.1 and ICAP (bsc#1216500).
- CVE-2023-46847: Denial of Service in HTTP Digest Authentication (bsc#1216495).
- CVE-2023-46724: Fix validation of certificates with CN=* (bsc#1216803).
- CVE-2023-46848: Denial of Service in FTP (bsc#1216498).
- Record
SUSE-SU-2023:4381-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4384-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2023-46846: Request/Response smuggling in HTTP/1.1 and ICAP (bsc#1216500).
- CVE-2023-46847: Denial of Service in HTTP Digest Authentication (bsc#1216495).
- CVE-2023-46724: Fix validation of certificates with CN=* (bsc#1216803).
- CVE-2023-46848: Denial of Service in FTP (bsc#1216498).
- Record
SUSE-SU-2023:4384-1- Updated
- 2026-11-02
OSVUSN-6500-1 No score
squid vulnerabilities
Joshua Rogers discovered that Squid incorrectly handled validating certain SSL certificates. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-46724)
Joshua Rogers discovered that Squid incorrectly handled the Gopher protocol. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. Gopher support has been disabled in this update. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-46728)
Keran Mu and Jianjun Chen discovered that Squid incorrectly handled the chunked decoder. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2023-46846)
Joshua Rogers discovered that Squid incorrectly handled HTTP Digest Authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-46847)
Joshua Rogers discovered that Squid incorrectly handled certain FTP urls. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-46848)
- Record
USN-6500-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidAlpine:v3.19 |
5.0.3 up to 6.4-r0 | 6.4-r0 |
squidAlpine:v3.20 |
5.0.3 up to 6.4-r0 | 6.4-r0 |
squidAlpine:v3.21 |
5.0.3 up to 6.4-r0 | 6.4-r0 |
squidAlpine:v3.22 |
5.0.3 up to 6.4-r0 | 6.4-r0 |
squidAlpine:v3.23 |
5.0.3 up to 6.4-r0 | 6.4-r0 |
squidAlpine:v3.24 |
5.0.3 up to 6.4-r0 | 6.4-r0 |
squidAlmaLinux:9 From an advisory covering 3 CVEs |
before 7:5.5-5.el9_2.1 | 7:5.5-5.el9_2.1 |
squidAlmaLinux:9 From an advisory covering 3 CVEs |
before 7:5.5-6.el9_3.1 | 7:5.5-6.el9_3.1 |
squidAzure Linux:3 |
through 6.13-5 | None known |
squidAzure Linux:2 |
through 5.7-5 | None known |
Show 39 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squidTuxCare:CentOS:8.5 From an advisory covering 3 CVEs |
before 7:4.15-1.module_el8.5.0+2143+24c223d9.tuxcare.els4 | 7:4.15-1.module_el8.5.0+2143+24c223d9.tuxcare.els4 |
squidTuxCare:CentOS-Stream:8 |
before 7:4.15-10.module_el8+2366+bbf49637.tuxcare.els4 | 7:4.15-10.module_el8+2366+bbf49637.tuxcare.els4 |
squidDebian:12 |
before 5.7-2+deb12u1, plus listed versions 5.7-2 |
5.7-2+deb12u1 |
squidDebian:13 |
before 6.5-1 | 6.5-1 |
squidDebian:14 |
before 6.5-1 | 6.5-1 |
squidMageia:9 From an advisory covering 3 CVEs |
before 5.9-1.1.mga9 | 5.9-1.1.mga9 |
squidRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 7:5.5-5.el9_2.1 | 7:5.5-5.el9_2.1 |
squid-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 7:5.5-5.el9_2.1 | 7:5.5-5.el9_2.1 |
squid-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 7:5.5-5.el9_2.1 | 7:5.5-5.el9_2.1 |
squidRed Hat:rhel_eus:9.0::appstream From an advisory covering 3 CVEs |
before 7:5.2-1.el9_0.3 | 7:5.2-1.el9_0.3 |
squid-debuginfoRed Hat:rhel_eus:9.0::appstream From an advisory covering 3 CVEs |
before 7:5.2-1.el9_0.3 | 7:5.2-1.el9_0.3 |
squid-debugsourceRed Hat:rhel_eus:9.0::appstream From an advisory covering 3 CVEs |
before 7:5.2-1.el9_0.3 | 7:5.2-1.el9_0.3 |
squidRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 7:5.5-6.el9_3.1 | 7:5.5-6.el9_3.1 |
squid-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 7:5.5-6.el9_3.1 | 7:5.5-6.el9_3.1 |
squid-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 7:5.5-6.el9_3.1 | 7:5.5-6.el9_3.1 |
squidRocky Linux:9 From an advisory covering 3 CVEs |
before 7:5.5-5.el9_2.1 | 7:5.5-5.el9_2.1 |
squidRoot:Alpine:3.18 |
before 5.9-r00071 | 5.9-r000715.9-r000745.9-r000735.9-r000725.9-r00075 |
rootio-squidRoot:Alpine:3.18 |
before 5.9-r00071 | 5.9-r000715.9-r000745.9-r000735.9-r000725.9-r00075 |
squidSUSE:Linux Enterprise Module for Server Applications 15 SP4 From an advisory covering 4 CVEs |
before 5.7-150400.3.12.1 | 5.7-150400.3.12.1 |
squidSUSE:Linux Enterprise Module for Server Applications 15 SP5 From an advisory covering 4 CVEs |
before 5.7-150400.3.12.1 | 5.7-150400.3.12.1 |
squidopenSUSE:Leap 15.4 From an advisory covering 4 CVEs |
before 5.7-150400.3.12.1 | 5.7-150400.3.12.1 |
squidopenSUSE:Leap 15.5 From an advisory covering 4 CVEs |
before 5.7-150400.3.12.1 | 5.7-150400.3.12.1 |
squidSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 4 CVEs |
before 4.17-4.30.1 | 4.17-4.30.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 4 CVEs |
before 4.17-4.30.1 | 4.17-4.30.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidSUSE:Enterprise Storage 7.1 From an advisory covering 4 CVEs |
before 4.17-150000.5.38.1 | 4.17-150000.5.38.1 |
squidUbuntu:22.04:LTS |
before 5.7-0ubuntu0.22.04.2, plus listed versions 4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.15.2-1ubuntu4.25.2-1ubuntu4.35.7-0ubuntu0.22.04.1 |
5.7-0ubuntu0.22.04.2 |
squidUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 4.10-1ubuntu1.8, plus listed versions 4.8-1ubuntu24.8-1ubuntu34.9-2ubuntu14.9-2ubuntu24.9-2ubuntu3 Show 9 moreShow less4.9-2ubuntu44.10-1ubuntu14.10-1ubuntu1.14.10-1ubuntu1.24.10-1ubuntu1.34.10-1ubuntu1.44.10-1ubuntu1.54.10-1ubuntu1.64.10-1ubuntu1.7 |
4.10-1ubuntu1.8 |
squidUbuntu:22.04:LTS From an advisory covering 5 CVEs |
before 5.7-0ubuntu0.22.04.2, plus listed versions 4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.15.2-1ubuntu4.25.2-1ubuntu4.35.7-0ubuntu0.22.04.1 |
5.7-0ubuntu0.22.04.2 |
squidopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 6.4-1.1 | 6.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46848 is a high vulnerability (CVSS 8.6) in Squid-cache Squid, published November 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.4%, the 96th percentile. Fixed in squid 6.4-r0.
References
access.redhat.com/errata/RHSA-2023:6266
bugzilla.redhat.com/show_bug.cgi?id=2245919
github.com/squid-cache/squid/security/advisories/GHSA-2g3c-pg7q-g59w
Show 52 moreShow less
security.netapp.com/advisory/ntap-20231214-0005
security.alpinelinux.org/vuln/CVE-2023-46848
errata.almalinux.org/9/ALSA-2023-6266.html
nvd.nist.gov/vuln/detail/CVE-2023-46848
errata.cloudlinux.com/centos8.5-els/CLSA-2023-1700161280.html
errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1775643576.html
security-tracker.debian.org/tracker/CVE-2023-46848
advisories.mageia.org/MGASA-2023-0315.html
bugs.mageia.org/show_bug.cgi?id=32486
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6266.json
cve.org/CVERecord?id=CVE-2023-46846
errata.rockylinux.org/RLSA-2023:6266
suse.com/support/update/announcement/2023/suse-su-20234380-1
bugzilla.suse.com/1216495
ubuntu.com/security/CVE-2023-46848
lists.squid-cache.org/pipermail/squid-announce/2023-October/000157.html
megamansec.github.io/Squid-Security-Audit/ftp-assert.html