PT-2023-8819 · Squid+11 · Squid+12
Joshua Rogers
·
Published
2023-10-12
·
Updated
2025-04-10
·
CVE-2024-25111
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Squid versions 3.5.27 through 6.7
Description
The issue is related to an uncontrolled recursion bug in the HTTP Chunked decoder, which can lead to a Denial of Service attack. A remote attacker can exploit this by sending a crafted, chunked, encoded HTTP Message. This problem is associated with a buffer overflow on the stack due to the uncontrolled recursion when processing HTTP messages.
Recommendations
For Squid versions 3.5.27 through 6.7, update to version 6.8 or apply patches from Squid's patch archives to resolve the issue.
At the moment, there is no workaround for this issue, so updating or patching is the only resolution.
Exploit
Fix
DoS
Stack Overflow
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu