GHSA-543M-W2M2-G255: Squid: dos against http and https

Published Nov 3, 2023

Updated

A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service.

Affected Software

1 affected component

Squid Squid

Event History

Nov 3, 2023

CVE Published

via OSV·07:56 AM

Data Sourced

via OSV·07:56 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to cause Squid to cache an HTTP response whose headers later grow beyond the configured maximum size. When Squid retrieves that oversized cached header from disk, a worker process can stall or crash.

Is a network-reachable Squid deployment affected without authentication?

The supplied CVSS vector indicates network exploitation with low attack complexity, no privileges, and no user interaction required. The impact described is denial of service against a Squid worker process.

How can I determine whether an instance may be affected?

Investigate worker stalls or crashes occurring when responses are retrieved from the disk cache, particularly where cached HTTP response headers exceed the configured header-size limit. The provided data does not identify affected or fixed Squid versions.

GHSA-543M-W2M2-G255: Squid: dos against http and https

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Is a network-reachable Squid deployment affected without authentication?

How can I determine whether an instance may be affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Is a network-reachable Squid deployment affected without authentication?

How can I determine whether an instance may be affected?