Read the docs
TI-2007-05954 Aliases CVE-2007-6239GHSA-6pw6-cgf2-h2v8

The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and…

Priority MEDIUM 45CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.

Why it matters now

EPSS 0.26659 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:squid:squid_web_proxy_cache:2.0_patch2:*:*:*:*:*:*:*2.0_patch2VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.1_patch2:*:*:*:*:*:*:*2.1_patch2VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.3.stable4:*:*:*:*:*:*:*2.3.stable4VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.3.stable5:*:*:*:*:*:*:*2.3.stable5VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable2:*:*:*:*:*:*:*2.4_stable2VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable4:*:*:*:*:*:*:*2.4_stable4VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable6:*:*:*:*:*:*:*2.4_stable6VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable7:*:*:*:*:*:*:*2.4_stable7VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable11:*:*:*:*:*:*:*2.5.stable11VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable12:*:*:*:*:*:*:*2.5.stable12VulnerableSquid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.0_patch2:*:*:*:*:*:*:* Versions 2.0_patch2 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.1_patch2:*:*:*:*:*:*:* Versions 2.1_patch2 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.3.stable4:*:*:*:*:*:*:* Versions 2.3.stable4 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.3.stable5:*:*:*:*:*:*:* Versions 2.3.stable5 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable2:*:*:*:*:*:*:* Versions 2.4_stable2 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable4:*:*:*:*:*:*:* Versions 2.4_stable4 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable6:*:*:*:*:*:*:* Versions 2.4_stable6 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable7:*:*:*:*:*:*:* Versions 2.4_stable7 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable11:*:*:*:*:*:*:* Versions 2.5.stable11 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable12:*:*:*:*:*:*:* Versions 2.5.stable12 Vulnerable ·Squid
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable13:*:*:*:*:*:*:*2.5.stable13VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable14:*:*:*:*:*:*:*2.5.stable14VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_.stable9:*:*:*:*:*:*:*2.5_.stable9VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable1:*:*:*:*:*:*:*2.5_stable1VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable3:*:*:*:*:*:*:*2.5_stable3VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable4:*:*:*:*:*:*:*2.5_stable4VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable5:*:*:*:*:*:*:*2.5_stable5VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable6:*:*:*:*:*:*:*2.5_stable6VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable7:*:*:*:*:*:*:*2.5_stable7VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable8:*:*:*:*:*:*:*2.5_stable8VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable10:*:*:*:*:*:*:*2.5_stable10VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6:*:*:*:*:*:*:*2.6VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable1:*:*:*:*:*:*:*2.6.stable1VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable2:*:*:*:*:*:*:*2.6.stable2VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable3:*:*:*:*:*:*:*2.6.stable3VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable4:*:*:*:*:*:*:*2.6.stable4VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable5:*:*:*:*:*:*:*2.6.stable5VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable6:*:*:*:*:*:*:*2.6.stable6VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable7:*:*:*:*:*:*:*2.6.stable7VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable12:*:*:*:*:*:*:*2.6.stable12VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable13:*:*:*:*:*:*:*2.6.stable13VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable14:*:*:*:*:*:*:*2.6.stable14VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable15:*:*:*:*:*:*:*2.6.stable15VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable16:*:*:*:*:*:*:*2.6.stable16VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:3.0:*:*:*:*:*:*:*3.0VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre1:*:*:*:*:*:*:*3.0_pre1VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre2:*:*:*:*:*:*:*3.0_pre2VulnerableSquid
cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre3:*:*:*:*:*:*:*3.0_pre3VulnerableSquid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable13:*:*:*:*:*:*:* Versions 2.5.stable13 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable14:*:*:*:*:*:*:* Versions 2.5.stable14 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_.stable9:*:*:*:*:*:*:* Versions 2.5_.stable9 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable1:*:*:*:*:*:*:* Versions 2.5_stable1 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable3:*:*:*:*:*:*:* Versions 2.5_stable3 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable4:*:*:*:*:*:*:* Versions 2.5_stable4 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable5:*:*:*:*:*:*:* Versions 2.5_stable5 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable6:*:*:*:*:*:*:* Versions 2.5_stable6 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable7:*:*:*:*:*:*:* Versions 2.5_stable7 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable8:*:*:*:*:*:*:* Versions 2.5_stable8 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable10:*:*:*:*:*:*:* Versions 2.5_stable10 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable1:*:*:*:*:*:*:* Versions 2.6.stable1 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable2:*:*:*:*:*:*:* Versions 2.6.stable2 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable3:*:*:*:*:*:*:* Versions 2.6.stable3 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable4:*:*:*:*:*:*:* Versions 2.6.stable4 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable5:*:*:*:*:*:*:* Versions 2.6.stable5 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable6:*:*:*:*:*:*:* Versions 2.6.stable6 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable7:*:*:*:*:*:*:* Versions 2.6.stable7 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable12:*:*:*:*:*:*:* Versions 2.6.stable12 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable13:*:*:*:*:*:*:* Versions 2.6.stable13 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable14:*:*:*:*:*:*:* Versions 2.6.stable14 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable15:*:*:*:*:*:*:* Versions 2.6.stable15 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable16:*:*:*:*:*:*:* Versions 2.6.stable16 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre1:*:*:*:*:*:*:* Versions 3.0_pre1 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre2:*:*:*:*:*:*:* Versions 3.0_pre2 Vulnerable ·Squid
  • cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre3:*:*:*:*:*:*:* Versions 3.0_pre3 Vulnerable ·Squid

Remediation

Red Hat 1 advisory

  • RHSA-2007:1130 Released 2007-12-18 · Red Hat rating Moderate
    squid security update
    • Red Hat Desktop version 3 squid-7:2.5.STABLE3-8.3E, squid-7:2.5.STABLE3-8.3E.i386
    • Red Hat Enterprise Linux (v. 5 server) squid-7:2.6.STABLE6-5.el5_1.2, squid-7:2.6.STABLE6-5.el5_1.2.i386, squid-7:2.6.STABLE6-5.el5_1.2.ia64 +1
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1 squid-7:2.4.STABLE7-1.21as.11, squid-7:2.4.STABLE7-1.21as.11.i386, squid-7:2.4.STABLE7-1.21as.11.ia64
    • Red Hat Enterprise Linux AS version 3 squid-7:2.5.STABLE3-8.3E, squid-7:2.5.STABLE3-8.3E.i386, squid-7:2.5.STABLE3-8.3E.ia64 +1
    • Red Hat Enterprise Linux AS version 4 squid-7:2.5.STABLE14-1.4E.el4_6.1, squid-7:2.5.STABLE14-1.4E.el4_6.1.i386, squid-7:2.5.STABLE14-1.4E.el4_6.1.ia64 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) squid-7:2.6.STABLE6-5.el5_1.2, squid-7:2.6.STABLE6-5.el5_1.2.i386
    • Red Hat Enterprise Linux Desktop version 4 squid-7:2.5.STABLE14-1.4E.el4_6.1, squid-7:2.5.STABLE14-1.4E.el4_6.1.i386
    • Red Hat Enterprise Linux ES version 2.1 squid-7:2.4.STABLE7-1.21as.11, squid-7:2.4.STABLE7-1.21as.11.i386
    • Red Hat Enterprise Linux ES version 3 squid-7:2.5.STABLE3-8.3E, squid-7:2.5.STABLE3-8.3E.i386, squid-7:2.5.STABLE3-8.3E.ia64
    • Red Hat Enterprise Linux ES version 4 squid-7:2.5.STABLE14-1.4E.el4_6.1, squid-7:2.5.STABLE14-1.4E.el4_6.1.i386, squid-7:2.5.STABLE14-1.4E.el4_6.1.ia64
    • Red Hat Enterprise Linux WS version 3 squid-7:2.5.STABLE3-8.3E, squid-7:2.5.STABLE3-8.3E.i386, squid-7:2.5.STABLE3-8.3E.ia64
    • Red Hat Enterprise Linux WS version 4 squid-7:2.5.STABLE14-1.4E.el4_6.1, squid-7:2.5.STABLE14-1.4E.el4_6.1.i386, squid-7:2.5.STABLE14-1.4E.el4_6.1.ia64
    • Red Hat Linux Advanced Workstation 2.1 squid-7:2.4.STABLE7-1.21as.11, squid-7:2.4.STABLE7-1.21as.11.ia64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2007:1130
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2007:1130
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2007:1130
Red Hat Enterprise Linux AS version 3Fixed RHSA-2007:1130
Red Hat Enterprise Linux AS version 4Fixed RHSA-2007:1130
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2007:1130
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2007:1130
Red Hat Enterprise Linux ES version 2.1Fixed RHSA-2007:1130
Red Hat Enterprise Linux ES version 3Fixed RHSA-2007:1130
Red Hat Enterprise Linux ES version 4Fixed RHSA-2007:1130
Red Hat Enterprise Linux WS version 3Fixed RHSA-2007:1130
Red Hat Enterprise Linux WS version 4Fixed RHSA-2007:1130
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2007:1130

Timeline

  1. 2026-10-02 Threatist record created from CVE-2007-6239
  2. 2026-10-03 Alias added: GHSA-6pw6-cgf2-h2v8

References

Exploit 1

Patch 3

Advisory 9

Other 3

  • TI-2009-00761 Squid, when transparent interception mode is enabled, uses the HTTP Host header to… CVSS 2.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences