PT-2023-7041 · Squid+10 · Squid+11

Jianjun Chen + 1 · Published 2023-10-19 · Updated 2026-03-29 · CVE-2023-46846

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Squid (affected versions not specified)

Description The issue is related to the chunked decoder of the Squid proxy server, which is associated with the server's interpretation of fragmented syntax encoding. This can allow a remote attacker to perform Request/Response smuggling past firewall and frontend security systems, potentially enabling direct interaction with the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALSA-2023:6266

ALSA-2023:6267

ALSA-2023:6748

ALSA-2023:7213

ALT-PU-2023-7250

ALT-PU-2023-7254

ALT-PU-2023-7461

ALT-PU-2024-9370

AZL-31905

BDU:2023-08063

CESA-2023_6267

CESA-2023_7213

CVE-2023-46846

DLA-3709-1

DLA-3709-2

DSA-5637-1

GHSA-J83V-W3P4-5CQH

MGASA-2023-0315

OESA-2023-1776

OPENSUSE-SU-2023_4380-1

OPENSUSE-SU-2024:13398-1

RHSA-2023:6266

RHSA-2023:6267

RHSA-2023:6268

RHSA-2023:6748

RHSA-2023:6801

RHSA-2023:6803

RHSA-2023:6804

RHSA-2023:6810

RHSA-2023:7213

RHSA-2023_6266

RHSA-2023_6267

RHSA-2023_6748

RHSA-2023_7213

RHSA-2024:11049

RLSA-2023:6266

RLSA-2023:6267

RLSA-2023:7213

ROSA-SA-2024-2477

ROSA-SA-2025-2759

SUSE-SU-2023:4380-1

SUSE-SU-2023:4381-1

SUSE-SU-2023:4384-1

USN-6500-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Squid

Squid Cache

Suse

Ubuntu

References · 103

• https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:6268 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:6266 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4384-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46847 · Security Note
• https://ubuntu.com/security/CVE-2023-46847 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0315.html · Security Note
• https://access.redhat.com/errata/RHSA-2023:7213 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:6801 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4380-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2023-6267.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:11049 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46724 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:6748 · Vendor Advisory