Read the docs
TI-2024-16566 Aliases CVE-2024-25111

SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

Priority HIGH 79CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-674.

Summary

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.65254 99th percentileScored 2026-11-07
Fix Fixed squid (squid-cache): 6.8Red Hat: 8 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
squid-cachesquid3.5.27 to before 6.86.8Patch availableCNA
  • squid Vendorsquid-cache Affected 3.5.27 to before 6.8 Fixed in 6.8 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*3.5.27 to before 6.8Vulnerablesquid-cache
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* Versions 3.5.27 to before 6.8 Vulnerable ·squid-cache
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
  • cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA squid (squid-cache) Fixed in 6.8

Red Hat 8 advisories

  • RHSA-2024:2822 Released 2024-05-13 · Red Hat rating Important
    squid:4 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.aarch64::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.s390x::squid:4 +11
  • RHSA-2024:2777 Released 2024-05-09 · Red Hat rating Important
    squid:4 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.src::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4, libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 +2
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.src::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 +5
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.src::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4, libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 +2
  • RHSA-2024:1833 Released 2024-04-16 · Red Hat rating Important
    squid security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) squid-7:5.2-1.el9_0.6
Show 5 more Red Hat advisories
  • RHSA-2024:1832 Released 2024-04-16 · Red Hat rating Important
    squid:4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.src::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4, libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 +2
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.src::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.src::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4, libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77.x86_64::squid:4 +2
  • RHSA-2024:1515 Released 2024-03-26 · Red Hat rating Important
    squid security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) squid-7:5.5-5.el9_2.6
  • RHSA-2024:1479 Released 2024-03-25 · Red Hat rating Important
    squid:4 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) libecap-1.0.1-2.module+el8.1.0+4044+36416a77.aarch64::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.ppc64le::squid:4, libecap-1.0.1-2.module+el8.1.0+4044+36416a77.s390x::squid:4 +11
  • RHSA-2024:1375 Released 2024-03-19 · Red Hat rating Important
    squid:4 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libecap-1.0.1-2.module+el8.9.0+19703+a1da7223.aarch64::squid:4, libecap-1.0.1-2.module+el8.9.0+19703+a1da7223.ppc64le::squid:4, libecap-1.0.1-2.module+el8.9.0+19703+a1da7223.s390x::squid:4 +11
  • RHSA-2024:1376 Released 2024-03-19 · Red Hat rating Important
    squid security update
    • Red Hat Enterprise Linux AppStream (v. 9) squid-7:5.5-6.el9_3.8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:1375
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:1376
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:2777
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:1832
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2024:2777
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:1832
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:1479
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:2822
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:1833
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:1515
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2024:2777
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:1832
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25111

References

Patch 1

Advisory 2

Other 2

  • TI-2025-38486 Squid vulnerable to information disclosure via authentication credential leakage in error handling CVSS 3.1CRITICAL 10.0
  • TI-2024-16845 Denial of Service in HTTP Header parser in squid proxy CVSS 3.1HIGH 7.5
  • TI-2023-26921 Denial of Service in HTTP Message Processing in Squid CVSS 3.1HIGH 8.6
  • TI-2023-27496 SQUID-2023:10 Denial of Service in HTTP Request parsing CVSS 3.1HIGH 8.6
  • TI-2023-25306 Squid: denial of service in http digest authentication CVSS 3.1HIGH 8.6
  • TI-2016-03919 client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the… CVSS 3.0HIGH 8.6
See all 110 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences