What’s Vulnerable › Vulnerabilities

CVE-2023-46846: Squid: request/response smuggling in http/1.1 and icap

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-03 · updated 2026-06-17
• Weakness: CWE-444

Description

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

Affected products

• Red Hat Enterprise Linux: 8.0, 9.0
• RedHat Enterprise Linux Eus: 8.6, 8.8, 9.0, 9.2
• RedHat Enterprise Linux For Arm 64: 8.0_aarch64
• RedHat Enterprise Linux For Ibm Z Systems: 8.0_s390x
• RedHat Enterprise Linux For Power Little Endian: 8.0_ppc64le
• RedHat Enterprise Linux Server Aus: 8.2, 8.4, 8.6, 9.2
• RedHat Enterprise Linux Server Tus: 8.2, 8.4, 8.6, 8.8, 9.2
• Squid: from 2.6 before 6.4 — fixed in 6.4

How to fix

Upgrade to a fixed version: Squid 6.4. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2023:6266
• https://access.redhat.com/errata/RHSA-2023:6267
• https://access.redhat.com/errata/RHSA-2023:6268
• https://access.redhat.com/errata/RHSA-2023:6748
• https://access.redhat.com/errata/RHSA-2023:6801
• https://access.redhat.com/errata/RHSA-2023:6803
• https://access.redhat.com/errata/RHSA-2023:6804
• https://access.redhat.com/errata/RHSA-2023:6810
• https://access.redhat.com/errata/RHSA-2023:7213
• https://access.redhat.com/errata/RHSA-2024:11049
• https://access.redhat.com/security/cve/CVE-2023-46846
• https://bugzilla.redhat.com/show_bug.cgi?id=2245910

Get alerted when CVE-2023-46846 or the next vulnerability affects your stack