CVE-2024-37894
Squid vulnerable to heap corruption in ESI assign
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Squid vulnerable to heap corruption in ESI assign
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
- Record
CVE-2024-37894- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2024-36874
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
- Record
EUVD-2024-36874- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
- Record
CVE-2024-37894- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Squid vulnerable to heap corruption in ESI assign
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
- Record
CVE-2024-37894- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-37894
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
- Record
DEBIAN-CVE-2024-37894- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1785
squid security update
Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.
Security Fix(es):
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.(CVE-2024-37894)
- Record
OESA-2024-1785- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
Show 18 moreShow less
OSVRHSA-2024:4861
Red Hat Security Advisory: squid security update
- Record
RHSA-2024:4861- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:5906
Red Hat Security Advisory: squid security update
- Record
RHSA-2024:5906- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-37894
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
- Record
UBUNTU-CVE-2024-37894- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2024:4861 No score
Moderate: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
Security Fix(es):
- squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638)
- squid: Out-of-bounds write error may lead to Denial of Service (CVE-2024-37894)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2024:4861- Updated
- 2026-11-02
OSVAZL-42871 No score
CVE-2024-37894 affecting package squid 5.7-5
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.
- Record
AZL-42871- Updated
- 2026-11-02
OSVCLSA-2024-1725012247 No score
Fix CVE(s): CVE-2024-37894
- SECURITY UPDATE: Memory Corruption via Out-of-bounds Write in ESI variables
assignment
- debian/patches/CVE-2024-37894.patch: fix incorrect type declaration in TrieNode.cc to prevent potential type conversion issues
- CVE-2024-37894
- Record
CLSA-2024-1725012247- Updated
- 2026-11-02
OSVCLSA-2024-1725012269 No score
Fix CVE(s): CVE-2024-37894
- SECURITY UPDATE: Memory Corruption via Out-of-bounds Write in ESI variable
assignment
- debian/patches/CVE-2024-37894.patch: fix incorrect type declaration in TrieNode.cc to prevent potential type conversion issues
- CVE-2024-37894
- Record
CLSA-2024-1725012269- Updated
- 2026-11-02
OSVCLSA-2025-1736860159 No score
squid: Fix of 2 CVEs
- CVE-2024-23638: Fix Denial of Service attack against Cache Manager error responses
- CVE-2024-37894: Fix Out-of-bounds Write error when assigning ESI variables
- Record
CLSA-2025-1736860159- Updated
- 2026-11-02
OSVMGASA-2024-0265 No score
Updated squid packages fix security vulnerability
Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack. (CVE-2024-37894)
- Record
MGASA-2024-0265- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14080-1 No score
squid-6.10-1.1 on GA media
These are all security issues fixed in the squid-6.10-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14080-1- Updated
- 2026-11-02
OSVRLSA-2024:4861 No score
Moderate: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.
Security Fix(es):
-
squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638)
-
squid: Out-of-bounds write error may lead to Denial of Service (CVE-2024-37894)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2024:4861- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-318-CVE-2024-37894 No score
CVE-2024-37894 in squid - Patched by Root
Root has patched CVE-2024-37894 in the squid package for Root:Alpine:3.18. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-318-CVE-2024-37894- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-320-CVE-2024-37894 No score
CVE-2024-37894 in squid - Patched by Root
Root has patched CVE-2024-37894 in the squid package for Root:Alpine:3.20. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-320-CVE-2024-37894- Updated
- 2026-11-02
OSVSUSE-SU-2024:2268-1 No score
Security update for squid
This update for squid fixes the following issues:
- Update to version 6.10
- CVE-2024-37894: Fixed a denial of Service issue in ESI processing (bsc#1227086)
- Record
SUSE-SU-2024:2268-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2269-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2024-37894: Fixed a denial of Service issue in ESI processing (bsc#1227086)
- Record
SUSE-SU-2024:2269-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2270-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2024-37894: Fixed a denial of Service issue in ESI processing (bsc#1227086)
- Record
SUSE-SU-2024:2270-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03521-1 No score
Security update for squid
This update for squid fixes the following issues:
- CVE-2025-59362: fixed buffer overflow (bsc#1250627)
- CVE-2024-37894: fixed denial of service in ESI processing (bsc#1227086)
- CVE-2024-33427: fixed possible buffer overread leading to denial of service (bsc#1225417)
- Record
SUSE-SU-2025:03521-1- Updated
- 2026-11-02
OSVUSN-6907-1 No score
squid, squid3 vulnerability
Joshua Rogers discovered that Squid did not properly handle multi-byte
characters during Edge Side Includes (ESI) processing. A remote attacker
could possibly use this issue to cause a memory corruption error, leading
to a denial of service.
- Record
USN-6907-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidAlmaLinux:9 From an advisory covering 2 CVEs |
before 7:5.5-13.el9_4 | 7:5.5-13.el9_4 |
squidAzure Linux:2 |
through 5.7-5 | None known |
squidTuxCare:Ubuntu:16.04 |
before 3.5.12-1ubuntu7.17+tuxcare.els9 | 3.5.12-1ubuntu7.17+tuxcare.els9 |
squid-cgiTuxCare:Ubuntu:16.04 |
before 3.5.12-1ubuntu7.17+tuxcare.els9 | 3.5.12-1ubuntu7.17+tuxcare.els9 |
squid-commonTuxCare:Ubuntu:16.04 |
before 3.5.12-1ubuntu7.17+tuxcare.els9 | 3.5.12-1ubuntu7.17+tuxcare.els9 |
squid-purgeTuxCare:Ubuntu:16.04 |
before 3.5.12-1ubuntu7.17+tuxcare.els9 | 3.5.12-1ubuntu7.17+tuxcare.els9 |
squid3TuxCare:Ubuntu:16.04 |
before 3.5.12-1ubuntu7.17+tuxcare.els9 | 3.5.12-1ubuntu7.17+tuxcare.els9 |
squidclientTuxCare:Ubuntu:16.04 |
before 3.5.12-1ubuntu7.17+tuxcare.els9 | 3.5.12-1ubuntu7.17+tuxcare.els9 |
squidTuxCare:Ubuntu:18.04 |
before 3.5.27-1ubuntu1.14+tuxcare.els7 | 3.5.27-1ubuntu1.14+tuxcare.els7 |
squid-cgiTuxCare:Ubuntu:18.04 |
before 3.5.27-1ubuntu1.14+tuxcare.els7 | 3.5.27-1ubuntu1.14+tuxcare.els7 |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squid-commonTuxCare:Ubuntu:18.04 |
before 3.5.27-1ubuntu1.14+tuxcare.els7 | 3.5.27-1ubuntu1.14+tuxcare.els7 |
squid-purgeTuxCare:Ubuntu:18.04 |
before 3.5.27-1ubuntu1.14+tuxcare.els7 | 3.5.27-1ubuntu1.14+tuxcare.els7 |
squid3TuxCare:Ubuntu:18.04 |
before 3.5.27-1ubuntu1.14+tuxcare.els7 | 3.5.27-1ubuntu1.14+tuxcare.els7 |
squidclientTuxCare:Ubuntu:18.04 |
before 3.5.27-1ubuntu1.14+tuxcare.els7 | 3.5.27-1ubuntu1.14+tuxcare.els7 |
squidTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 7:5.5-5.el9_2.1.tuxcare.els5 | 7:5.5-5.el9_2.1.tuxcare.els5 |
squidDebian:12 |
before 5.7-2+deb12u2, plus listed versions 5.7-25.7-2+deb12u1 |
5.7-2+deb12u2 |
squidDebian:13 |
before 6.10-1 | 6.10-1 |
squidDebian:14 |
before 6.10-1 | 6.10-1 |
squidDebian:11 From an advisory covering 3 CVEs |
before 4.13-10+deb11u4, plus listed versions 4.13-104.13-10+deb11u14.13-10+deb11u24.13-10+deb11u3 |
4.13-10+deb11u4 |
squidMageia:9 |
before 5.9-1.4.mga9 | 5.9-1.4.mga9 |
squidopenEuler:22.03-LTS-SP1 |
before 4.9-25.oe2203sp1 | 4.9-25.oe2203sp1 |
squidopenEuler:22.03-LTS-SP3 |
before 4.9-25.oe2203sp3 | 4.9-25.oe2203sp3 |
squidopenEuler:20.03-LTS-SP4 |
before 4.9-21.oe2003sp4 | 4.9-21.oe2003sp4 |
squidopenEuler:24.03-LTS |
before 6.6-3.oe2403 | 6.6-3.oe2403 |
squidopenEuler:22.03-LTS-SP4 |
before 4.9-25.oe2203sp4 | 4.9-25.oe2203sp4 |
squidRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 7:5.5-13.el9_4 | 7:5.5-13.el9_4 |
squid-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 7:5.5-13.el9_4 | 7:5.5-13.el9_4 |
squid-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 7:5.5-13.el9_4 | 7:5.5-13.el9_4 |
squidRed Hat:rhel_eus:9.2::appstream |
before 7:5.5-5.el9_2.7 | 7:5.5-5.el9_2.7 |
squid-debuginfoRed Hat:rhel_eus:9.2::appstream |
before 7:5.5-5.el9_2.7 | 7:5.5-5.el9_2.7 |
squid-debugsourceRed Hat:rhel_eus:9.2::appstream |
before 7:5.5-5.el9_2.7 | 7:5.5-5.el9_2.7 |
squidRocky Linux:9 From an advisory covering 2 CVEs |
before 7:5.5-13.el9_4 | 7:5.5-13.el9_4 |
squidRoot:Alpine:3.18 |
before 5.9-r00071 | 5.9-r000715.9-r000745.9-r000735.9-r000725.9-r00075 |
rootio-squidRoot:Alpine:3.18 |
before 5.9-r00071 | 5.9-r000715.9-r000745.9-r000735.9-r000725.9-r00075 |
squidRoot:Alpine:3.20 |
before 6.9-r00071 | 6.9-r000716.9-r000726.9-r000746.9-r000736.9-r00075 |
rootio-squidRoot:Alpine:3.20 |
before 6.9-r00071 | 6.9-r000716.9-r000726.9-r000746.9-r000736.9-r00075 |
squidSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 6.10-150600.3.6.1 | 6.10-150600.3.6.1 |
squidopenSUSE:Leap 15.6 |
before 6.10-150600.3.6.1 | 6.10-150600.3.6.1 |
squidSUSE:Linux Enterprise Module for Server Applications 15 SP5 |
before 5.7-150400.3.32.1 | 5.7-150400.3.32.1 |
squidopenSUSE:Leap 15.5 |
before 5.7-150400.3.32.1 | 5.7-150400.3.32.1 |
squidSUSE:Linux Enterprise Server 12 SP5 |
before 4.17-4.50.1 | 4.17-4.50.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 4.17-4.50.1 | 4.17-4.50.1 |
squidSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 3 CVEs |
before 4.17-150000.5.55.1 | 4.17-150000.5.55.1 |
squidSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 3 CVEs |
before 4.17-150000.5.55.1 | 4.17-150000.5.55.1 |
squidSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 3 CVEs |
before 4.17-150000.5.55.1 | 4.17-150000.5.55.1 |
squidSUSE:Enterprise Storage 7.1 From an advisory covering 3 CVEs |
before 4.17-150000.5.55.1 | 4.17-150000.5.55.1 |
squid3Ubuntu:Pro:16.04:LTS |
before 3.5.12-1ubuntu7.16+esm4, plus listed versions 3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.1 Show 18 moreShow less3.5.12-1ubuntu7.23.5.12-1ubuntu7.33.5.12-1ubuntu7.43.5.12-1ubuntu7.53.5.12-1ubuntu7.63.5.12-1ubuntu7.73.5.12-1ubuntu7.83.5.12-1ubuntu7.93.5.12-1ubuntu7.103.5.12-1ubuntu7.113.5.12-1ubuntu7.123.5.12-1ubuntu7.133.5.12-1ubuntu7.143.5.12-1ubuntu7.153.5.12-1ubuntu7.163.5.12-1ubuntu7.16+esm13.5.12-1ubuntu7.16+esm23.5.12-1ubuntu7.16+esm3 |
3.5.12-1ubuntu7.16+esm4 |
squid3Ubuntu:Pro:18.04:LTS |
before 3.5.27-1ubuntu1.14+esm3, plus listed versions 3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.13.5.27-1ubuntu1.2 Show 14 moreShow less3.5.27-1ubuntu1.33.5.27-1ubuntu1.43.5.27-1ubuntu1.53.5.27-1ubuntu1.63.5.27-1ubuntu1.73.5.27-1ubuntu1.83.5.27-1ubuntu1.93.5.27-1ubuntu1.103.5.27-1ubuntu1.113.5.27-1ubuntu1.123.5.27-1ubuntu1.133.5.27-1ubuntu1.143.5.27-1ubuntu1.14+esm13.5.27-1ubuntu1.14+esm2 |
3.5.27-1ubuntu1.14+esm3 |
squidUbuntu:20.04:LTS |
before 4.10-1ubuntu1.13, plus listed versions 4.8-1ubuntu24.8-1ubuntu34.9-2ubuntu14.9-2ubuntu24.9-2ubuntu3 Show 14 moreShow less4.9-2ubuntu44.10-1ubuntu14.10-1ubuntu1.14.10-1ubuntu1.24.10-1ubuntu1.34.10-1ubuntu1.44.10-1ubuntu1.54.10-1ubuntu1.64.10-1ubuntu1.74.10-1ubuntu1.84.10-1ubuntu1.94.10-1ubuntu1.104.10-1ubuntu1.114.10-1ubuntu1.12 |
4.10-1ubuntu1.13 |
squidUbuntu:22.04:LTS |
before 5.9-0ubuntu0.22.04.2, plus listed versions 4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.1 Show 7 moreShow less5.2-1ubuntu4.25.2-1ubuntu4.35.7-0ubuntu0.22.04.15.7-0ubuntu0.22.04.25.7-0ubuntu0.22.04.35.7-0ubuntu0.22.04.45.9-0ubuntu0.22.04.1 |
5.9-0ubuntu0.22.04.2 |
squidUbuntu:24.04:LTS |
before 6.6-1ubuntu5.1, plus listed versions 6.1-2ubuntu16.1-2ubuntu26.5-1ubuntu16.5-1ubuntu26.5-1ubuntu36.6-1ubuntu46.6-1ubuntu5 |
6.6-1ubuntu5.1 |
squidopenSUSE:Tumbleweed |
before 6.10-1.1 | 6.10-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-37894 is a medium vulnerability (CVSS 6.3) in Squid-cache Squid, published June 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.25%, the 93rd percentile. Fixed in squid 3.5.12-1ubuntu7.17+tuxcare.els9.
References
github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg
security.netapp.com/advisory/ntap-20240719-0001
lists.debian.org/debian-lts-announce/2025/03/msg00009.html
access.redhat.com/errata/RHSA-2024:4861
Show 43 moreShow less
bugzilla.redhat.com/2260051
errata.almalinux.org/9/ALSA-2024-4861.html
nvd.nist.gov/vuln/detail/CVE-2024-37894
errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1725012247.html
errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1736860159.html
security-tracker.debian.org/tracker/CVE-2024-37894
advisories.mageia.org/MGASA-2024-0265.html
bugs.mageia.org/show_bug.cgi?id=33363
lists.suse.com/pipermail/sle-security-updates/2024-July/018842.html
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-1785
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4861.json
cve.org/CVERecord?id=CVE-2024-23638
squid-cache.org/Versions/v5/SQUID-2023_11.patch
megamansec.github.io/Squid-Security-Audit/stream-assert.html
errata.rockylinux.org/RLSA-2024:4861
suse.com/support/update/announcement/2024/suse-su-20242268-1
bugzilla.suse.com/1227086
ubuntu.com/security/CVE-2024-37894