CVE-2024-23638

Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.

• CWE-825
• CWE-672

• http://www.squid-cache.org/Versions/v5/SQUID-2023_11.patchMailing List, Patch
• http://www.squid-cache.org/Versions/v6/SQUID-2023_11.patchMailing List, Patch
• https://github.com/squid-cache/squid/commit/290ae202883ac28a48867079c2fb34c40efd382bPatch
• https://github.com/squid-cache/squid/commit/e8118a7381213f5cfcdeb4cec1d2d854bfd261c8Patch
• https://github.com/squid-cache/squid/security/advisories/GHSA-j49p-553x-48rxVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/
• https://megamansec.github.io/Squid-Security-Audit/stream-assert.htmlExploit
• https://security.netapp.com/advisory/ntap-20240208-0010/
• http://www.squid-cache.org/Versions/v5/SQUID-2023_11.patchMailing List, Patch
• http://www.squid-cache.org/Versions/v6/SQUID-2023_11.patchMailing List, Patch
• https://github.com/squid-cache/squid/commit/290ae202883ac28a48867079c2fb34c40efd382bPatch
• https://github.com/squid-cache/squid/commit/e8118a7381213f5cfcdeb4cec1d2d854bfd261c8Patch
• https://github.com/squid-cache/squid/security/advisories/GHSA-j49p-553x-48rxVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/
• https://megamansec.github.io/Squid-Security-Audit/stream-assert.htmlExploit
• https://security.netapp.com/advisory/ntap-20240208-0010/

Published

Jan 24, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23630An arbitrary firmware upload vulnerability exists in the Mot…8.8
• CVE-2024-23633Label Studio, an open source data labeling tool had a remote…6.1
• CVE-2024-23634GeoServer is an open source software server written in Java …6
• CVE-2024-23635AntiSamy is a library for performing fast, configurable clea…6.1
• CVE-2024-23636SOFARPC is a Java RPC framework. SOFARPC defaults to using t…9.8
• CVE-2024-23637OctoPrint is a web interface for 3D printer.s OctoPrint vers…4.9
• CVE-2024-23639Micronaut Framework is a modern, JVM-based, full stack Java …7.8
• CVE-2024-2364A vulnerability classified as problematic has been found in …4.6
• CVE-2024-23640GeoServer is an open source software server written in Java …4.8
• CVE-2024-23641SvelteKit is a web development kit. In SvelteKit 2, sending …7.5
• CVE-2024-23642GeoServer is an open source software server written in Java …4.8
• CVE-2024-23643GeoServer is an open source software server written in Java …4.8