{"id":"CVE-2024-37894","aliases":["ALSA-2024:4861","AZL-42871","CLSA-2024-1725012247","CLSA-2024-1725012269","CLSA-2025-1736860159","DEBIAN-CVE-2024-37894","DLA-4083-1","DSA-5751-1","EUVD-2024-36874","GHSA-wgvf-q977-9xjg","MGASA-2024-0265","OESA-2024-1785","RHSA-2024:4861","RHSA-2024:5906","RLSA-2024:4861","ROOT-OS-ALPINE-318-CVE-2024-37894","ROOT-OS-ALPINE-320-CVE-2024-37894","SUSE-SU-2024:2268-1","SUSE-SU-2024:2269-1","SUSE-SU-2024:2270-1","SUSE-SU-2025:03521-1","UBUNTU-CVE-2024-37894","USN-6907-1","openSUSE-SU-2024:14080-1"],"status":"published","title":"Squid vulnerable to heap corruption in ESI assign","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.06255,"percentile":0.93618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2024-06-25T19:39:02Z","modified":"2026-11-02T12:02:41Z","fixes":[{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-cgi","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-common","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-purge","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squid3","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"squidclient","fixed_in":["3.5.12-1ubuntu7.17+tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-cgi","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-common","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-purge","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squid3","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"squidclient","fixed_in":["3.5.27-1ubuntu1.14+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"squid","fixed_in":["5.7-2+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squid","fixed_in":["6.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squid","fixed_in":["6.10-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"squid","fixed_in":["5.9-1.4.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"squid","fixed_in":["4.9-25.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"squid","fixed_in":["4.9-25.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"squid","fixed_in":["4.9-21.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"squid","fixed_in":["6.6-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"squid","fixed_in":["4.9-25.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"squid","fixed_in":["7:5.5-5.el9_2.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"squid-debuginfo","fixed_in":["7:5.5-5.el9_2.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"squid-debugsource","fixed_in":["7:5.5-5.el9_2.7"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"squid","fixed_in":["5.9-r00071","5.9-r00074","5.9-r00073","5.9-r00072","5.9-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"rootio-squid","fixed_in":["5.9-r00071","5.9-r00074","5.9-r00073","5.9-r00072","5.9-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"squid","fixed_in":["6.9-r00071","6.9-r00072","6.9-r00074","6.9-r00073","6.9-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-squid","fixed_in":["6.9-r00071","6.9-r00072","6.9-r00074","6.9-r00073","6.9-r00075"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"squid","fixed_in":["6.10-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"squid","fixed_in":["6.10-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"squid","fixed_in":["5.7-150400.3.32.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"squid","fixed_in":["5.7-150400.3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"squid","fixed_in":["4.17-4.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"squid","fixed_in":["4.17-4.50.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"squid3","fixed_in":["3.5.12-1ubuntu7.16+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"squid3","fixed_in":["3.5.27-1ubuntu1.14+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"squid","fixed_in":["4.10-1ubuntu1.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"squid","fixed_in":["5.9-0ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"squid","fixed_in":["6.6-1ubuntu5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"squid","fixed_in":["6.10-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-13.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.7-5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid-purge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"squidclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.17+tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid-purge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"squidclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-5.el9_2.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-2+deb12u2"}]}],"versions":["5.7-2","5.7-2+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-10+deb11u4"}]}],"versions":["4.13-10","4.13-10+deb11u1","4.13-10+deb11u2","4.13-10+deb11u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-2+deb12u2"}]}],"versions":["5.7-2","5.7-2+deb12u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-1.4.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-25.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-25.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-21.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-25.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-13.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-13.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-13.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-5.el9_2.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-5.el9_2.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-5.el9_2.7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.5-13.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-r00071"},{"fixed":"5.9-r00074"},{"fixed":"5.9-r00073"},{"fixed":"5.9-r00072"},{"fixed":"5.9-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"rootio-squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-r00071"},{"fixed":"5.9-r00074"},{"fixed":"5.9-r00073"},{"fixed":"5.9-r00072"},{"fixed":"5.9-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-r00071"},{"fixed":"6.9-r00072"},{"fixed":"6.9-r00074"},{"fixed":"6.9-r00073"},{"fixed":"6.9-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-r00071"},{"fixed":"6.9-r00072"},{"fixed":"6.9-r00074"},{"fixed":"6.9-r00073"},{"fixed":"6.9-r00075"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.32.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-150400.3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-4.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-4.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17-150000.5.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.16+esm4"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4","3.5.12-1ubuntu7.5","3.5.12-1ubuntu7.6","3.5.12-1ubuntu7.7","3.5.12-1ubuntu7.8","3.5.12-1ubuntu7.9","3.5.12-1ubuntu7.10","3.5.12-1ubuntu7.11","3.5.12-1ubuntu7.12","3.5.12-1ubuntu7.13","3.5.12-1ubuntu7.14","3.5.12-1ubuntu7.15","3.5.12-1ubuntu7.16","3.5.12-1ubuntu7.16+esm1","3.5.12-1ubuntu7.16+esm2","3.5.12-1ubuntu7.16+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+esm3"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9","3.5.27-1ubuntu1.10","3.5.27-1ubuntu1.11","3.5.27-1ubuntu1.12","3.5.27-1ubuntu1.13","3.5.27-1ubuntu1.14","3.5.27-1ubuntu1.14+esm1","3.5.27-1ubuntu1.14+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.13"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3","4.10-1ubuntu1.4","4.10-1ubuntu1.5","4.10-1ubuntu1.6","4.10-1ubuntu1.7","4.10-1ubuntu1.8","4.10-1ubuntu1.9","4.10-1ubuntu1.10","4.10-1ubuntu1.11","4.10-1ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-0ubuntu0.22.04.2"}]}],"versions":["4.13-10ubuntu5","5.2-1ubuntu1","5.2-1ubuntu3","5.2-1ubuntu4","5.2-1ubuntu4.1","5.2-1ubuntu4.2","5.2-1ubuntu4.3","5.7-0ubuntu0.22.04.1","5.7-0ubuntu0.22.04.2","5.7-0ubuntu0.22.04.3","5.7-0ubuntu0.22.04.4","5.9-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1ubuntu5.1"}]}],"versions":["6.1-2ubuntu1","6.1-2ubuntu2","6.5-1ubuntu1","6.5-1ubuntu2","6.5-1ubuntu3","6.6-1ubuntu4","6.6-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.16+esm4"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4","3.5.12-1ubuntu7.5","3.5.12-1ubuntu7.6","3.5.12-1ubuntu7.7","3.5.12-1ubuntu7.8","3.5.12-1ubuntu7.9","3.5.12-1ubuntu7.10","3.5.12-1ubuntu7.11","3.5.12-1ubuntu7.12","3.5.12-1ubuntu7.13","3.5.12-1ubuntu7.14","3.5.12-1ubuntu7.15","3.5.12-1ubuntu7.16","3.5.12-1ubuntu7.16+esm1","3.5.12-1ubuntu7.16+esm2","3.5.12-1ubuntu7.16+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.14+esm3"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9","3.5.27-1ubuntu1.10","3.5.27-1ubuntu1.11","3.5.27-1ubuntu1.12","3.5.27-1ubuntu1.13","3.5.27-1ubuntu1.14","3.5.27-1ubuntu1.14+esm1","3.5.27-1ubuntu1.14+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.13"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3","4.10-1ubuntu1.4","4.10-1ubuntu1.5","4.10-1ubuntu1.6","4.10-1ubuntu1.7","4.10-1ubuntu1.8","4.10-1ubuntu1.9","4.10-1ubuntu1.10","4.10-1ubuntu1.11","4.10-1ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-0ubuntu0.22.04.2"}]}],"versions":["4.13-10ubuntu5","5.2-1ubuntu1","5.2-1ubuntu3","5.2-1ubuntu4","5.2-1ubuntu4.1","5.2-1ubuntu4.2","5.2-1ubuntu4.3","5.7-0ubuntu0.22.04.1","5.7-0ubuntu0.22.04.2","5.7-0ubuntu0.22.04.3","5.7-0ubuntu0.22.04.4","5.9-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1ubuntu5.1"}]}],"versions":["6.1-2ubuntu1","6.1-2ubuntu2","6.5-1ubuntu1","6.5-1ubuntu2","6.5-1ubuntu3","6.6-1ubuntu4","6.6-1ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10-1.1"}]}]}],"products":[{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/squid-cache/squid/commit/f411fe7d75197852f0e5ee85027a06d58dd8df4c.patch","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20240719-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00009.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4861","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23638","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-37894","tags":["report"]},{"url":"https://bugzilla.redhat.com/2260051","tags":["report"]},{"url":"https://bugzilla.redhat.com/2294353","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-4861.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37894","tags":["web","advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1725012247.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1725012269.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1736860159.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37894.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-37894","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0265.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33363","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2024-July/018842.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1785","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294353","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4861.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23638","tags":["advisory"]},{"url":"http://www.squid-cache.org/Versions/v5/SQUID-2023_11.patch","tags":["article"]},{"url":"http://www.squid-cache.org/Versions/v6/SQUID-2023_11.patch","tags":["article"]},{"url":"https://github.com/squid-cache/squid/commit/290ae202883ac28a48867079c2fb34c40efd382b","tags":["article"]},{"url":"https://github.com/squid-cache/squid/commit/e8118a7381213f5cfcdeb4cec1d2d854bfd261c8","tags":["article"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-j49p-553x-48rx","tags":["article"]},{"url":"https://megamansec.github.io/Squid-Security-Audit/stream-assert.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37894","tags":["advisory","report"]},{"url":"https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5906","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5906.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4861","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242268-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227086","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37894","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242269-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242270-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503521-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225417","tags":["report"]},{"url":"https://bugzilla.suse.com/1250627","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59362","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-37894","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6907-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-37894","title":"Squid vulnerable to heap corruption in ESI assign","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.","status":"published","published":"2024-06-25T19:39:02.376Z","modified":"2025-11-03T20:38:02.746Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-36874","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.","status":"published","published":"2024-06-25T19:39:02Z","modified":"2025-11-03T20:38:02Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:32.126029Z"}],"nvd":[{"id":"CVE-2024-37894","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.","status":"published","published":"2024-06-25T20:15:11.873Z","modified":"2026-06-17T07:39:00.22Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"CVE-2024-37894","title":"Squid vulnerable to heap corruption in ESI assign","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.","status":"published","published":"2024-06-25T19:39:02.376Z","modified":"2026-11-11T10:46:54.988015869Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2024-37894","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.","status":"published","published":"2024-06-25T20:15:11.873Z","modified":"2026-11-02T12:02:41.971887719Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"OESA-2024-1785","title":"squid security update","description":"Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.\n\nSecurity Fix(es):\n\nSquid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.(CVE-2024-37894)","status":"published","published":"2024-07-05T11:07:15Z","modified":"2026-08-18T01:18:27.318268224Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:4861","title":"Red Hat Security Advisory: squid security update","status":"published","published":"2024-09-16T20:34:55Z","modified":"2026-03-18T11:35:21.762495Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5906","title":"Red Hat Security Advisory: squid security update","status":"published","published":"2024-09-16T20:35:04Z","modified":"2026-03-18T11:31:39.362708Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2024-37894","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.","status":"published","published":"2024-06-25T20:15:00Z","modified":"2026-02-04T03:38:14.981503Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"ALSA-2024:4861","title":"Moderate: squid security update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638)\n* squid: Out-of-bounds write error may lead to Denial of Service (CVE-2024-37894)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-25T00:00:00Z","modified":"2026-10-29T11:31:48.351464311Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-42871","title":"CVE-2024-37894 affecting package squid 5.7-5","description":"Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.","status":"published","published":"2024-06-25T20:15:11Z","modified":"2026-04-21T04:30:47.019826Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CLSA-2024-1725012247","title":"Fix CVE(s): CVE-2024-37894","description":"   * SECURITY UPDATE: Memory Corruption via Out-of-bounds Write in ESI variables\n     assignment\n     - debian/patches/CVE-2024-37894.patch: fix incorrect type declaration in\n       TrieNode.cc to prevent potential type conversion issues\n     - CVE-2024-37894","status":"published","published":"2024-08-30T10:04:10Z","modified":"2026-06-04T10:04:05.803486Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1725012269","title":"Fix CVE(s): CVE-2024-37894","description":"   * SECURITY UPDATE: Memory Corruption via Out-of-bounds Write in ESI variable\n     assignment\n     - debian/patches/CVE-2024-37894.patch: fix incorrect type declaration in\n       TrieNode.cc to prevent potential type conversion issues\n     - CVE-2024-37894","status":"published","published":"2024-08-30T10:04:32Z","modified":"2026-06-04T10:04:02.416224Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1736860159","title":"squid: Fix of 2 CVEs","description":"- CVE-2024-23638: Fix Denial of Service attack against Cache Manager error responses\n- CVE-2024-37894: Fix Out-of-bounds Write error when assigning ESI variables","status":"published","published":"2025-01-14T13:09:25Z","modified":"2026-06-01T00:30:22.828021778Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"DLA-4083-1","title":"squid - security update","status":"published","published":"2025-03-11T00:00:00Z","modified":"2026-03-09T01:23:01.557028Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5751-1","title":"squid - security update","status":"published","published":"2024-08-19T00:00:00Z","modified":"2026-03-09T02:10:50.14807Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0265","title":"Updated squid packages fix security vulnerability","description":"Due to an Out-of-bounds Write error when assigning ESI variables, Squid\nis susceptible to a Memory Corruption error. This error can lead to a\nDenial of Service attack. (CVE-2024-37894)\n","status":"published","published":"2024-07-14T05:23:38Z","modified":"2026-04-16T04:43:52.165278844Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14080-1","title":"squid-6.10-1.1 on GA media","description":"These are all security issues fixed in the squid-6.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-27T00:00:00Z","modified":"2026-02-04T03:44:55.195903Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RLSA-2024:4861","title":"Moderate: squid security update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638)\n\n* squid: Out-of-bounds write error may lead to Denial of Service (CVE-2024-37894)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-26T12:33:59.522203Z","modified":"2026-02-05T04:15:13.494626Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"ROOT-OS-ALPINE-318-CVE-2024-37894","title":"CVE-2024-37894 in squid - Patched by Root","description":"Root has patched CVE-2024-37894 in the squid package for Root:Alpine:3.18. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:43:34Z","modified":"2026-09-29T11:15:04.428448522Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2024-37894","title":"CVE-2024-37894 in squid - Patched by Root","description":"Root has patched CVE-2024-37894 in the squid package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:42:41Z","modified":"2026-09-29T11:15:05.587848647Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2024:2268-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- Update to version 6.10\n- CVE-2024-37894: Fixed a denial of Service issue in ESI processing (bsc#1227086)\n","status":"published","published":"2024-07-02T09:06:07Z","modified":"2026-02-04T04:37:55.573851Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2269-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- CVE-2024-37894: Fixed a denial of Service issue in ESI processing (bsc#1227086)\n","status":"published","published":"2024-07-02T09:06:22Z","modified":"2026-02-04T04:18:07.809307Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2270-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- CVE-2024-37894: Fixed a denial of Service issue in ESI processing (bsc#1227086)\n","status":"published","published":"2024-07-02T09:06:35Z","modified":"2026-02-04T04:15:21.103872Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:03521-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- CVE-2025-59362: fixed buffer overflow (bsc#1250627)\n- CVE-2024-37894: fixed denial of service in ESI processing (bsc#1227086)\n- CVE-2024-33427: fixed possible buffer overread leading to denial of service (bsc#1225417)\n","status":"published","published":"2025-10-10T07:23:03Z","modified":"2026-02-04T02:40:40.621274Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-6907-1","title":"squid, squid3 vulnerability","description":"Joshua Rogers discovered that Squid did not properly handle multi-byte     \ncharacters during Edge Side Includes (ESI) processing. A remote attacker\ncould possibly use this issue to cause a memory corruption error, leading \nto a denial of service.\n","status":"published","published":"2024-07-23T15:24:29Z","modified":"2026-06-25T13:32:28.806364348Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}