PT-2023-8580 · Squid+10 · Squid+11
Joshua Rogers
·
Published
2023-09-26
·
Updated
2025-09-27
·
CVE-2023-46728
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Squid versions prior to 6.0.1
Description
The issue is related to a NULL pointer dereference bug in Squid's Gopher gateway, making it vulnerable to a Denial of Service attack. The gopher protocol is always available and enabled in Squid prior to version 6.0.1. Responses that trigger this bug can be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1.
Recommendations
For Squid versions prior to 6.0.1, users are advised to upgrade to version 6.0.1 or later to resolve the issue.
As a temporary workaround for users unable to upgrade, reject all gopher URL requests to minimize the risk of exploitation.
Exploit
Fix
DoS
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu