CVE-2024-23638

Deeper analysis

Squid, a widely deployed caching proxy for the Web, contains an expired pointer reference vulnerability that affects all releases prior to version 6.6. The flaw resides in Cache Manager error-response handling and permits a denial-of-service condition when error pages are generated for Client Manager reports. All Squid-5.x releases through 5.9 and all Squid-6.x releases through 6.5 are confirmed vulnerable; earlier branches before 5.0.5 have not been tested but should be treated as affected. The issue is tracked as CWE-825 and CWE-672 and carries a CVSS 3.1 score of 6.5.

A trusted client with network access can trigger the bug by issuing requests that cause the Cache Manager to produce error responses. Successful exploitation results in a high-impact denial of service that affects availability while leaving confidentiality and integrity untouched. Because the attack requires only low privileges and no user interaction, any authenticated client permitted to reach the Cache Manager interface can mount the attack.

Official patches addressing the flaw are available in the Squid-5 and Squid-6 patch archives as well as in the commits referenced by the GitHub security advisory. The project also publishes the workaround of denying Cache Manager access through Squid’s primary access-control rules with the directive “http_access deny manager.”

The associated EPSS score has remained in the 0.12–0.14 range since disclosure, indicating moderate but not sharply increasing exploitation interest.