CVE-2024-23638
Squid-Cache Squid 5.0 – 5.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-23638 is a medium-severity Expired Pointer Dereference (CWE-825) vulnerability in Squid-Cache Squid. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Squid, a widely deployed caching proxy for the Web, contains an expired pointer reference vulnerability that affects all releases prior to version 6.6. The flaw resides in Cache Manager error-response handling and permits a denial-of-service condition when error pages are generated for Client Manager reports. All Squid-5.x releases through 5.9 and all Squid-6.x releases through 6.5 are confirmed vulnerable; earlier branches before 5.0.5 have not been tested but should be treated as affected. The issue is tracked as CWE-825 and CWE-672 and carries a CVSS 3.1 score of 6.5.
A trusted client with network access can trigger the bug by issuing requests that cause the Cache Manager to produce error responses. Successful exploitation results in a high-impact denial of service that affects availability while leaving confidentiality and integrity untouched. Because the attack requires only low privileges and no user interaction, any authenticated client permitted to reach the Cache Manager interface can mount the attack.
Official patches addressing the flaw are available in the Squid-5 and Squid-6 patch archives as well as in the commits referenced by the GitHub security advisory. The project also publishes the workaround of denying Cache Manager access through Squid’s primary access-control rules with the directive “http_access deny manager.”
The associated EPSS score has remained in the 0.12–0.14 range since disclosure, indicating moderate but not sharply increasing exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21127
Vulnerability Data
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to…
more
perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement applies current authorizations to every request, directly blocking operations once a resource has been revoked or released.
Authenticator management mandates revocation and replacement procedures that render expired credentials unusable.
Developer testing and evaluation (including fuzzing, static analysis, and dynamic memory checkers) directly finds expired-pointer dereferences before deployment.
Account lifecycle management includes explicit revocation and disabling steps that stop subsequent operations on released accounts or identifiers.
Identifier management requires deallocation and reuse controls that prevent continued use of released identifiers.
Secure engineering principles applied during design and implementation can mandate memory-safe allocation, ownership, and deallocation patterns that structurally avoid use of expired pointers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Lifecycle management includes secure development and maintenance phases that reduce memory-safety defects.
Vulnerability identification processes can discover use-after-free flaws via scanning or analysis.
Routine patching and replacement can eliminate known instances of expired-pointer bugs.
Secure-development practices directly prevent coding errors such as use-after-free while one CWE contributes only modestly to the full control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Enforces timely deletion of resources so they cannot be used after release.
Secure development lifecycle practices can include pointer lifetime and memory-management rules that reduce expired-pointer dereferences.
A.8.26 only requires that security requirements (including resilience against attacks such as buffer overflows or SQL injection) be identified and specified during development or acquisition; it does not itself stop an expired pointer dereference from being introduced or from remaining exploitable in the resulting application.
A.8.27 establishes and applies secure-by-design principles, architecture reviews, and hardening that can surface or avoid many classes of memory errors, but it does not stop an already-written expired-pointer dereference from being exploitable; that requires code changes (removal) or runtime mitigations (e.g. ASLR, bounds checking) supplied by other controls.
Secure coding standards directly address pointer lifetime and deallocation discipline, substantially mitigating expired-pointer dereference.
Security testing can detect use-after-free issues, but removing this weakness alone does not fulfill the testing control.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-672, a class-level weakness, and none of its children carries one either.