CVE-2023-49286: Denial of Service in Helper Process management

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-04 · updated 2026-06-17
Weakness: CWE-253

Description

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

Squid: through 6.4

References

http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch
https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264
https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27
https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/
https://security.netapp.com/advisory/ntap-20240119-0004/
http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch
https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264
https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27
https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/

Get alerted when CVE-2023-49286 or the next vulnerability affects your stack