CVE-2024-23638
Squid-Cache Squid 5.0 – 5.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2024-23638 is a medium-severity Expired Pointer Dereference (CWE-825) vulnerability in Squid-Cache Squid. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Squid, a widely deployed caching proxy for the Web, contains an expired pointer reference vulnerability that affects all releases prior to version 6.6. The flaw resides in Cache Manager error-response handling and permits a denial-of-service condition when error pages are generated for Client Manager reports. All Squid-5.x releases through 5.9 and all Squid-6.x releases through 6.5 are confirmed vulnerable; earlier branches before 5.0.5 have not been tested but should be treated as affected. The issue is tracked as CWE-825 and CWE-672 and carries a CVSS 3.1 score of 6.5.
A trusted client with network access can trigger the bug by issuing requests that cause the Cache Manager to produce error responses. Successful exploitation results in a high-impact denial of service that affects availability while leaving confidentiality and integrity untouched. Because the attack requires only low privileges and no user interaction, any authenticated client permitted to reach the Cache Manager interface can mount the attack.
Official patches addressing the flaw are available in the Squid-5 and Squid-6 patch archives as well as in the commits referenced by the GitHub security advisory. The project also publishes the workaround of denying Cache Manager access through Squid’s primary access-control rules with the directive “http_access deny manager.”
The associated EPSS score has remained in the 0.12–0.14 range since disclosure, indicating moderate but not sharply increasing exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21127
Vulnerability Data
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to…
more
perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement applies current authorizations to every request, directly blocking operations once a resource has been revoked or released.
Authenticator management mandates revocation and replacement procedures that render expired credentials unusable.
Developer testing and evaluation (including fuzzing, static analysis, and dynamic memory checkers) directly finds expired-pointer dereferences before deployment.
Account lifecycle management includes explicit revocation and disabling steps that stop subsequent operations on released accounts or identifiers.
Identifier management requires deallocation and reuse controls that prevent continued use of released identifiers.
Secure engineering principles applied during design and implementation can mandate memory-safe allocation, ownership, and deallocation patterns that structurally avoid use of expired pointers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing managed authorizations and revocations directly prevents post-release operations on credentials or entitlements.
Secure-development practices directly prevent coding errors such as use-after-free while one CWE contributes only modestly to the full control.
Lifecycle management includes secure development and maintenance phases that reduce memory-safety defects.
Vulnerability identification processes can discover use-after-free flaws via scanning or analysis.
Routine patching and replacement can eliminate known instances of expired-pointer bugs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect use-after-free issues, but removing this weakness alone does not fulfill the testing control.
Enforces timely deletion of resources so they cannot be used after release.
Secure development lifecycle practices can include pointer lifetime and memory-management rules that reduce expired-pointer dereferences.
Application security requirements may mandate safe memory handling, but eliminating this single weakness does not satisfy the broader requirement.
Secure architecture and engineering principles can prescribe memory-safety patterns, yet fixing only this weakness does not achieve the control.
Secure coding standards directly address pointer lifetime and deallocation discipline, substantially mitigating expired-pointer dereference.