CVE-2023-50269: SQUID-2023:10 Denial of Service in HTTP Request parsing
Last updated 24 July 2024
Other sources
Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the followxforwardedfor feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/squidto a version that resolves this vulnerability.Fixed in 6.6 - Upgrade
Upgrade
debian/squidto a version that resolves this vulnerability.Fixed in 5.7-2+deb12u5Fixed in 5.7-2+deb12u6Fixed in 6.13-2+deb13u3Fixed in 6.13-2+deb13u4Fixed in 7.8-1 - Upgrade
Upgrade
Squidto a version that resolves this vulnerability.Fixed in 6.6Patch SQUID-2023:10
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50269?
CVE-2023-50269 has been categorized as a Denial of Service vulnerability, potentially causing service disruptions.
How do I fix CVE-2023-50269?
The recommended fix for CVE-2023-50269 is to upgrade Squid to version 6.6 or later.
Which versions of Squid are affected by CVE-2023-50269?
CVE-2023-50269 affects Squid versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5.
Is there a workaround for CVE-2023-50269?
There are currently no official workarounds for the vulnerability; upgrading to a non-vulnerable version is recommended.
What type of attack can exploit CVE-2023-50269?
CVE-2023-50269 can be exploited through Denial of Service attacks specifically targeting HTTP request parsing.