Strix
26.1K

CVE-2023-50269

HIGHCVSS 7.5/10EPSS 57.63%

Last modified

CVE-2023-50269 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. EPSS estimates a 57.63% chance of exploitation in the next 30 days.

Description

Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
57.63%

99.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Squid-CacheSquid>= 3.1, <= 5.9
Squid-CacheSquid>= 6.0.1, <= 6.5
Squid-CacheSquid2.6
Squid-CacheSquid2.7

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-50269?
Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.
How severe is CVE-2023-50269?
CVE-2023-50269 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 57.63% probability of exploitation in the next 30 days.
How do I fix CVE-2023-50269?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2023

View all 2023CVEs →

Are you affected by CVE-2023-50269?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST