CVE-2023-46728

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.

• CWE-476

• https://github.com/squid-cache/squid/commit/6ea12e8fb590ac6959e9356a81aa3370576568c3Patch
• https://github.com/squid-cache/squid/security/advisories/GHSA-cg5h-v6vc-w33fVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
• https://security.netapp.com/advisory/ntap-20231214-0006/
• https://github.com/squid-cache/squid/commit/6ea12e8fb590ac6959e9356a81aa3370576568c3Patch
• https://github.com/squid-cache/squid/security/advisories/GHSA-cg5h-v6vc-w33fVendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
• https://security.netapp.com/advisory/ntap-20231214-0006/

Published

Nov 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46722The Pimcore Admin Classic Bundle provides a backend UI for P…6.1
• CVE-2023-46723lte-pic32-writer is a writer for PIC32 devices. In versions …7.5
• CVE-2023-46724Squid is a caching proxy for the Web. Due to an Improper Val…7.5
• CVE-2023-46725FoodCoopShop is open source software for food coops and loca…7.5
• CVE-2023-46726GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-46727GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-46729sentry-javascript provides Sentry SDKs for JavaScript. An un…6.1
• CVE-2023-4673Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-46730Group-Office is an enterprise CRM and groupware tool. In aff…8.8
• CVE-2023-46731XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2023-46732XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-46733Symfony is a PHP framework for web and console applications …6.5