CVE-2023-49285

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-126
• CWE-125

• http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patchBroken Link
• http://www.squid-cache.org/Versions/v6/SQUID-2023_7.patchBroken Link
• https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521bPatch
• https://github.com/squid-cache/squid/commit/deee944f9a12c9fd399ce52f3e2526bb573a9470Patch
• https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
• https://security.netapp.com/advisory/ntap-20240119-0004/
• http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patchBroken Link
• http://www.squid-cache.org/Versions/v6/SQUID-2023_7.patchBroken Link
• https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521bPatch
• https://github.com/squid-cache/squid/commit/deee944f9a12c9fd399ce52f3e2526bb573a9470Patch
• https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
• https://security.netapp.com/advisory/ntap-20240119-0004/

Published

Dec 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4928 SQL Injection in GitHub repository instantsoft/icms2 prior …7.2
• CVE-2023-49280XWiki Change Request is an XWiki application allowing to req…6.5
• CVE-2023-49281Calendarinho is an open source calendaring application to ma…6.1
• CVE-2023-49282msgraph-sdk-php is the Microsoft Graph Library for PHP. The …5.3
• CVE-2023-49283microsoft-graph-core the Microsoft Graph Library for PHP. Th…5.3
• CVE-2023-49284fish is a smart and user-friendly command line shell for mac…6.6
• CVE-2023-49286Squid is a caching proxy for the Web supporting HTTP, HTTPS,…7.5
• CVE-2023-49287TinyDir is a lightweight C directory and file reader. Buffer…9.8
• CVE-2023-49288Squid is a caching proxy for the Web supporting HTTP, HTTPS,…7.5
• CVE-2023-49289Ajax.NET Professional (AjaxPro) is an AJAX framework for Mic…5.4
• CVE-2023-4929All firmware versions of the NPort 5000 Series are affected …8.8
• CVE-2023-49290lestrrat-go/jwx is a Go module implementing various JWx (JWA…5.3