CVE-2023-50269: SQUID-2023:10 Denial of Service in HTTP Request parsing
Last updated 24 July 2024
Other sources
Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the followxforwardedfor feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50269?
CVE-2023-50269 has been categorized as a Denial of Service vulnerability, potentially causing service disruptions.
How do I fix CVE-2023-50269?
The recommended fix for CVE-2023-50269 is to upgrade Squid to version 6.6 or later.
Which versions of Squid are affected by CVE-2023-50269?
CVE-2023-50269 affects Squid versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5.
Is there a workaround for CVE-2023-50269?
There are currently no official workarounds for the vulnerability; upgrading to a non-vulnerable version is recommended.
What type of attack can exploit CVE-2023-50269?
CVE-2023-50269 can be exploited through Denial of Service attacks specifically targeting HTTP request parsing.