CVE-2023-49288

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.

• CWE-416

• https://github.com/squid-cache/squid/security/advisories/GHSA-rj5h-46j6-q2g5Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
• https://security.netapp.com/advisory/ntap-20240119-0006/
• https://github.com/squid-cache/squid/security/advisories/GHSA-rj5h-46j6-q2g5Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
• https://security.netapp.com/advisory/ntap-20240119-0006/

Published

Dec 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49282msgraph-sdk-php is the Microsoft Graph Library for PHP. The …5.3
• CVE-2023-49283microsoft-graph-core the Microsoft Graph Library for PHP. Th…5.3
• CVE-2023-49284fish is a smart and user-friendly command line shell for mac…6.6
• CVE-2023-49285Squid is a caching proxy for the Web supporting HTTP, HTTPS,…7.5
• CVE-2023-49286Squid is a caching proxy for the Web supporting HTTP, HTTPS,…7.5
• CVE-2023-49287TinyDir is a lightweight C directory and file reader. Buffer…9.8
• CVE-2023-49289Ajax.NET Professional (AjaxPro) is an AJAX framework for Mic…5.4
• CVE-2023-4929All firmware versions of the NPort 5000 Series are affected …8.8
• CVE-2023-49290lestrrat-go/jwx is a Go module implementing various JWx (JWA…5.3
• CVE-2023-49291tj-actions/branch-names is a Github action to retrieve branc…9.8
• CVE-2023-49292ecies is an Elliptic Curve Integrated Encryption Scheme for …4.8
• CVE-2023-49293Vite is a website frontend framework. When Vite's HTML trans…6.1