What’s Vulnerable › Vulnerabilities
CVE-2023-46847: Squid: denial of service in http digest authentication
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 78.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-11-03 · updated 2026-08-07
- Weakness: CWE-120
Description
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.
Affected products
- Red Hat Enterprise Linux: 8.0, 9.0
- RedHat Enterprise Linux Eus: 8.6, 8.8, 9.0, 9.2
- RedHat Enterprise Linux For Arm 64: 8.0_aarch64
- RedHat Enterprise Linux For Ibm Z Systems: 8.0_s390x
- RedHat Enterprise Linux For Power Little Endian: 8.0_ppc64le
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 8.2, 8.4, 8.6, 9.2
- RedHat Enterprise Linux Server Tus: 8.2, 8.4, 8.6, 8.8, 9.2
- RedHat Enterprise Linux Workstation: 7.0
- Squid: from 3.2.0.1 before 6.4 — fixed in 6.4
How to fix
Upgrade to a fixed version: Squid 6.4. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2023:6266
- https://access.redhat.com/errata/RHSA-2023:6267
- https://access.redhat.com/errata/RHSA-2023:6268
- https://access.redhat.com/errata/RHSA-2023:6748
- https://access.redhat.com/errata/RHSA-2023:6801
- https://access.redhat.com/errata/RHSA-2023:6803
- https://access.redhat.com/errata/RHSA-2023:6804
- https://access.redhat.com/errata/RHSA-2023:6805
- https://access.redhat.com/errata/RHSA-2023:6810
- https://access.redhat.com/errata/RHSA-2023:6882
- https://access.redhat.com/errata/RHSA-2023:6884
- https://access.redhat.com/errata/RHSA-2023:7213
Get alerted when CVE-2023-46847 or the next vulnerability affects your stack