{"id":"CVE-2023-49288","aliases":["ALPINE-CVE-2023-49288","ALSA-2023:7668","AZL-32073","CLSA-2024-1714462008","CLSA-2024-1716272474","CLSA-2025-1741034026","CLSA-2025-1761844638","CLSA-2026-1777054556","CLSA-2026-1777539711","CLSA-2026-1777539902","CLSA-2026-1777544744","DEBIAN-CVE-2023-49288","EUVD-2023-53281","GHSA-rj5h-46j6-q2g5","MGASA-2024-0126","RHSA-2023:7465","RHSA-2023:7668","SUSE-SU-2026:4909-1","UBUNTU-CVE-2023-49288","USN-6728-1","USN-6728-3","openSUSE-SU-2024:13631-1"],"status":"published","title":"Denial of Service in HTTP Collapsed Forwarding in Squid","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04777,"percentile":0.91982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2023-12-04T22:49:31Z","modified":"2026-11-06T10:58:10Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"squid","fixed_in":["6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"squid","fixed_in":["6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"squid","fixed_in":["6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"squid","fixed_in":["6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"squid","fixed_in":["6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"squid","fixed_in":["6.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-cgi","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-common","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-purge","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid3","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squidclient","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-cgi","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-common","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-purge","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid3","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squidclient","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"squid","fixed_in":["7:5.5-5.el9_2.1.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"squid","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"squid-migration-script","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"squid-sysvinit","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"squid","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"squid-migration-script","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"squid-sysvinit","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"squid","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"squid-migration-script","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"squid-sysvinit","fixed_in":["7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squid","fixed_in":["6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squid","fixed_in":["6.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"squid","fixed_in":["4.10-1ubuntu1.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"squid","fixed_in":["5.7-0ubuntu0.22.04.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5"},{"fixed":"6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5"},{"fixed":"6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5"},{"fixed":"6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5"},{"fixed":"6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5"},{"fixed":"6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5"},{"fixed":"6.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+2741+01592ae8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+3048+383bc947"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+2741+01592ae8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+3048+383bc947"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-7.module_el8.9.0+3696+b881db49.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.7-5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-purge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squidclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-purge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squidclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-5.el9_2.1.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"squid-cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"squid-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"squid-purge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"squidclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-19.el9_6.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.5.el7_9.99.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7-2","5.7-2+deb12u1","5.7-2+deb12u2","5.7-2+deb12u3","5.7-2+deb12u4","5.7-2+deb12u5","5.7-2+deb12u6","6.1-1","6.1-2","6.10-1","6.12-1","6.13-1","6.13-2","6.3-1","6.5-1","6.6-1","6.8-1","6.9-1","7.1-1","7.2-1","7.2-2","7.4-1","7.5-1","7.6-1","7.6-2","7.7-1"]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-1.3.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-6.el9_3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-6.el9_3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-6.el9_3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.9.0+19703+a1da7223"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.9.0+19703+a1da7223"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.9.0+19703+a1da7223"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.9.0+19703+a1da7223"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-7.module+el8.9.0+20806+014d88aa.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-7.module+el8.9.0+20806+014d88aa.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-7.module+el8.9.0+20806+014d88aa.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4","3.5.12-1ubuntu7.5","3.5.12-1ubuntu7.6","3.5.12-1ubuntu7.7","3.5.12-1ubuntu7.8","3.5.12-1ubuntu7.9","3.5.12-1ubuntu7.10","3.5.12-1ubuntu7.11","3.5.12-1ubuntu7.12","3.5.12-1ubuntu7.13","3.5.12-1ubuntu7.14","3.5.12-1ubuntu7.15","3.5.12-1ubuntu7.16","3.5.12-1ubuntu7.16+esm1","3.5.12-1ubuntu7.16+esm2","3.5.12-1ubuntu7.16+esm3","3.5.12-1ubuntu7.16+esm4","3.5.12-1ubuntu7.16+esm5","3.5.12-1ubuntu7.16+esm6","3.5.12-1ubuntu7.16+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9","3.5.27-1ubuntu1.10","3.5.27-1ubuntu1.11","3.5.27-1ubuntu1.12","3.5.27-1ubuntu1.13","3.5.27-1ubuntu1.14","3.5.27-1ubuntu1.14+esm1","3.5.27-1ubuntu1.14+esm2","3.5.27-1ubuntu1.14+esm3","3.5.27-1ubuntu1.14+esm4","3.5.27-1ubuntu1.14+esm5","3.5.27-1ubuntu1.14+esm6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.12"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3","4.10-1ubuntu1.4","4.10-1ubuntu1.5","4.10-1ubuntu1.6","4.10-1ubuntu1.7","4.10-1ubuntu1.8","4.10-1ubuntu1.9","4.10-1ubuntu1.10","4.10-1ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-0ubuntu0.22.04.4"}]}],"versions":["4.13-10ubuntu5","5.2-1ubuntu1","5.2-1ubuntu3","5.2-1ubuntu4","5.2-1ubuntu4.1","5.2-1ubuntu4.2","5.2-1ubuntu4.3","5.7-0ubuntu0.22.04.1","5.7-0ubuntu0.22.04.2","5.7-0ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.10"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3","4.10-1ubuntu1.4","4.10-1ubuntu1.5","4.10-1ubuntu1.6","4.10-1ubuntu1.7","4.10-1ubuntu1.8","4.10-1ubuntu1.9"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-0ubuntu0.22.04.4"}]}],"versions":["4.13-10ubuntu5","5.2-1ubuntu1","5.2-1ubuntu3","5.2-1ubuntu4","5.2-1ubuntu4.1","5.2-1ubuntu4.2","5.2-1ubuntu4.3","5.7-0ubuntu0.22.04.1","5.7-0ubuntu0.22.04.2","5.7-0ubuntu0.22.04.3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.12"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3","4.10-1ubuntu1.4","4.10-1ubuntu1.5","4.10-1ubuntu1.6","4.10-1ubuntu1.7","4.10-1ubuntu1.8","4.10-1ubuntu1.9","4.10-1ubuntu1.10","4.10-1ubuntu1.11"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-2.1"}]}],"bundled":5}],"products":[{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-rj5h-46j6-q2g5","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240119-0006/","tags":["x_transferred","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-49288","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7668","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2245914","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7668.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2023-49288.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-54574.html","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49288","tags":["web","advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1714462008.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1716272474.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1741034026.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1761844638.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777054556.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1777539711.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777539902.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777544744.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49288.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49288","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0126.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33091","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6728-1","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7465","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245914","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7465.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5824","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49288","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-54574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2386026","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-54574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54574","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988","tags":["article"]},{"url":"https://github.com/squid-cache/squid/releases/tag/SQUID_6_4","tags":["article"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7668.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264909-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216496","tags":["report"]},{"url":"https://bugzilla.suse.com/1217825","tags":["report"]},{"url":"https://bugzilla.suse.com/1223329","tags":["report"]},{"url":"https://bugzilla.suse.com/1228150","tags":["report"]},{"url":"https://bugzilla.suse.com/1252281","tags":["report"]},{"url":"https://bugzilla.suse.com/1260452","tags":["report"]},{"url":"https://bugzilla.suse.com/1260453","tags":["report"]},{"url":"https://bugzilla.suse.com/1260454","tags":["report"]},{"url":"https://bugzilla.suse.com/1268272","tags":["report"]},{"url":"https://bugzilla.suse.com/1268320","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50012","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-49288","tags":["report"]},{"url":"https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6728-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6728-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-5824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-25111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-25617","tags":["report"]},{"url":"https://launchpad.net/bugs/2060880","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23638","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-49288","title":"Denial of Service in HTTP Collapsed Forwarding in Squid","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","status":"published","published":"2023-12-04T22:49:31.317Z","modified":"2025-02-13T17:18:39.71Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-53281","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","status":"published","published":"2023-12-04T22:49:31Z","modified":"2025-02-13T17:18:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:48.029386Z"}],"nvd":[{"id":"CVE-2023-49288","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","status":"published","published":"2023-12-04T23:15:27.477Z","modified":"2026-06-17T06:35:46.503Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:08:52.544469Z"}],"osv":[{"id":"ALPINE-CVE-2023-49288","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","status":"published","published":"2023-12-04T23:15:27.477Z","modified":"2026-10-26T17:17:58.655694375Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-32073","title":"CVE-2023-49288 affecting package squid 5.7-5","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","status":"published","published":"2023-12-04T23:15:27Z","modified":"2026-04-21T04:26:39.018835Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"CVE-2023-49288","title":"Denial of Service in HTTP Collapsed Forwarding in Squid","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","status":"published","published":"2023-12-04T22:49:31.317Z","modified":"2026-11-06T10:57:01.227509857Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-06T11:08:47.346964Z"},{"id":"DEBIAN-CVE-2023-49288","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","status":"published","published":"2023-12-04T23:15:27.477Z","modified":"2026-10-26T18:02:50.232823761Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"RHSA-2023:7465","title":"Red Hat Security Advisory: squid security update","status":"published","published":"2024-09-16T15:58:46Z","modified":"2026-07-12T10:02:15Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7668","title":"Red Hat Security Advisory: squid:4 security update","status":"published","published":"2024-09-16T15:58:54Z","modified":"2026-07-12T10:02:17Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"UBUNTU-CVE-2023-49288","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with \"collapsed_forwarding on\" are vulnerable. Configurations with \"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.","status":"published","published":"2023-12-04T23:15:00Z","modified":"2026-10-20T22:45:08.301560031Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"ALSA-2023:7668","title":"Important: squid:4 security update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: DoS against HTTP and HTTPS (CVE-2023-5824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-12-06T00:00:00Z","modified":"2026-11-06T10:58:10.940372653Z","updated_at":"2026-11-06T11:08:40.431174Z"},{"id":"CLSA-2024-1714462008","title":"Fix CVE(s): CVE-2023-49288","description":"   * SECURITY UPDATE: Denial of Service attack against HTTP header parsing\n     - debian/patches/CVE-2023-49288.patch: fix unintention freeing in\n       TRACE request handler\n     - CVE-2023-49288","status":"published","published":"2024-04-30T07:26:51Z","modified":"2026-06-04T10:03:12.480077Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1716272474","title":"Fix CVE(s): CVE-2023-49288","description":"   * SECURITY UPDATE: Denial of Service attack against HTTP header parsing\n     - debian/patches/CVE-2023-49288.patch: fix unintentional freeing in\n       TRACE request handler\n     - CVE-2023-49288","status":"published","published":"2024-05-21T06:21:17Z","modified":"2026-06-04T10:04:22.455821Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2025-1741034026","title":"squid: Fix of CVE-2023-49288","description":"- CVE-2023-49288: fix Denial of Service in HTTP Collapsed Forwarding","status":"published","published":"2025-03-03T20:33:52Z","modified":"2026-06-01T00:30:31.098873127Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1761844638","title":"Fix CVE(s): CVE-2023-49288, CVE-2023-5824","description":"   * SECURITY UPDATE: excessive cached HTTP response header size causing worker\n     process stall or crash\n     - debian/patches/CVE-2023-5824.patch: Refactor serialized HTTP response header\n       handling to prevent cache flow\n     - CVE-2023-5824\n   * SECURITY UPDATE: Use-After-Free in the HTTP Collapsed Forwarding Feature\n     - debian/patches/CVE-2023-5824.patch: Removed Use-After-Free during refactor\n       serialized HTTP response header\n     - CVE-2023-49288","status":"published","published":"2025-10-30T18:04:01Z","modified":"2026-06-04T10:04:15.258591Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1777054556","title":"squid: Fix of 2 CVEs","description":"- CVE-2022-41317: fix exposure of sensitive cache manager information via\n  non-HTTP URI schemes due to typo in default manager ACL regex\n- CVE-2023-49288: fix use-after-free in StoreEntry::startWriting() reachable\n  via oversized replies with collapsed_forwarding enabled","status":"published","published":"2026-04-24T18:16:01Z","modified":"2026-06-01T00:32:48.69879427Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777539711","title":"squid: Fix of CVE-2023-49288","description":"- CVE-2023-49288: fix use-after-free in store_client lifetime by locking\n  StoreEntry for the duration of the store_client object","status":"published","published":"2026-04-30T09:39:24Z","modified":"2026-06-01T00:33:20.145803854Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777539902","title":"squid: Fix of CVE-2023-49288","description":"- CVE-2023-49288: fix use-after-free in store_client lifetime by locking\n  StoreEntry for the duration of the store_client object","status":"published","published":"2026-04-30T09:05:06Z","modified":"2026-06-01T00:33:27.305611999Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777544744","title":"squid: Fix of CVE-2023-49288","description":"- CVE-2023-49288: fix use-after-free in store_client lifetime by locking\n  StoreEntry for the duration of the store_client object","status":"published","published":"2026-05-02T01:11:59Z","modified":"2026-06-01T00:33:18.71510514Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"MGASA-2024-0126","title":"Updated squid packages fix security vulnerabilities","description":"Affected versions of squid are subject to a Use-After-Free bug which\ncan lead to a Denial of Service attack via collapsed forwarding. All\nversions of Squid from 3.5 up to and including 5.9 configured with\n\"collapsed_forwarding on\" are vulnerable. Configurations with\n\"collapsed_forwarding off\" or without a \"collapsed_forwarding\" directive\nare not vulnerable. (CVE-2023-49288)\nSquid is vulnerable to Denial of Service attack against HTTP and HTTPS\nclients due to an Improper Handling of Structural Elements bug.\n(CVE-2023-5824)\n","status":"published","published":"2024-04-12T20:45:19Z","modified":"2026-04-16T04:41:17.546311692Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13631-1","title":"squid-6.6-2.1 on GA media","description":"These are all security issues fixed in the squid-6.6-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:14.970905Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2026:4909-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- CVE-2023-5824: Multiple issues in HTTP response caching (bsc#1216496).\n- CVE-2023-49288: Use-After-Free in the HTTP Collapsed Forwarding Feature (bsc#1217825).\n- CVE-2025-62168: failure to redact HTTP authentication credentials in error handling leads to the disclosure of\n  credentials a trusted client uses to authenticate (bsc#1252281).\n- CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).\n- CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).\n- CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).\n- CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic\n  correctness of input (bsc#1268272).\n- CVE-2026-50012: Improper Input Validation bug (bsc#1268320).\n","status":"published","published":"2026-10-26T07:22:12Z","modified":"2026-10-26T20:15:05.607759754Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-6728-1","title":"squid vulnerabilities","description":"Joshua Rogers discovered that Squid incorrectly handled collapsed\nforwarding. A remote attacker could possibly use this issue to cause Squid\nto crash, resulting in a denial of service. This issue only affected Ubuntu\n20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)\n\nJoshua Rogers discovered that Squid incorrectly handled certain structural\nelements. A remote attacker could possibly use this issue to cause Squid to\ncrash, resulting in a denial of service. (CVE-2023-5824)\n\nJoshua Rogers discovered that Squid incorrectly handled Cache Manager error\nresponses. A remote trusted client can possibly use this issue to cause\nSquid to crash, resulting in a denial of service. (CVE-2024-23638)\n\nJoshua Rogers discovered that Squid incorrectly handled the HTTP Chunked\ndecoder. A remote attacker could possibly use this issue to cause Squid to\nstop responding, resulting in a denial of service. (CVE-2024-25111)\n\nJoshua Rogers discovered that Squid incorrectly handled HTTP header\nparsing. A remote trusted client can possibly use this issue to cause\nSquid to crash, resulting in a denial of service. (CVE-2024-25617)\n","status":"published","published":"2024-04-10T16:38:15Z","modified":"2026-04-27T17:17:23.502301109Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6728-3","title":"squid vulnerability","description":"USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused\nSquid to crash in certain environments on Ubuntu 20.04 LTS and was disabled\nin USN-6728-2. The problematic fix for CVE-2023-5824 has now been corrected\nand reinstated in this update.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Joshua Rogers discovered that Squid incorrectly handled collapsed\n forwarding. A remote attacker could possibly use this issue to cause Squid\n to crash, resulting in a denial of service. This issue only affected Ubuntu\n 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)\n \n Joshua Rogers discovered that Squid incorrectly handled certain structural\n elements. A remote attacker could possibly use this issue to cause Squid to\n crash, resulting in a denial of service. (CVE-2023-5824)\n \n Joshua Rogers discovered that Squid incorrectly handled Cache Manager error\n responses. A remote trusted client can possibly use this issue to cause\n Squid to crash, resulting in a denial of service. (CVE-2024-23638)\n \n Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked\n decoder. A remote attacker could possibly use this issue to cause Squid to\n stop responding, resulting in a denial of service. (CVE-2024-25111)\n \n Joshua Rogers discovered that Squid incorrectly handled HTTP header\n parsing. A remote trusted client can possibly use this issue to cause\n Squid to crash, resulting in a denial of service. (CVE-2024-25617)\n","status":"published","published":"2024-04-23T11:20:04Z","modified":"2026-04-27T17:11:06.117713Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}