UpHeron
All vulnerabilities

Servers and applications

CVE-2024-25617

SQUID-2024:2 Denial of Service in HTTP Header parser

Severity
High 7.5
Published
14 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.5
Also known as
GHSA-h5x6-w8mv-xfpr
Sources
NVD, Project advisories (GitHub)

Description

Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can…

Affected software

SoftwareAffected versions
SquidServers and applications · cpe:a:squid-cache:squid
  • From 3.0 before 6.5
SquidServers and applications · github:squid-cache/squid
  • Every version before 6.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-25617
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-25617
  • GitHub Advisory Database https://github.com/advisories/GHSA-h5x6-w8mv-xfpr
  • github.com https://github.com/squid-cache/squid/security/advisories/GHSA-h5x6-w8mv-xfpr