CVE-2023-5824: Squid: dos against http and https

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-03 · updated 2026-06-17
Weakness: CWE-755

Description

A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service.

Affected products

Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0
Squid: before 6.4 — fixed in 6.4

How to fix

Upgrade to a fixed version: Squid 6.4. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2023:7465
https://access.redhat.com/errata/RHSA-2023:7668
https://access.redhat.com/errata/RHSA-2024:0072
https://access.redhat.com/errata/RHSA-2024:0397
https://access.redhat.com/errata/RHSA-2024:0771
https://access.redhat.com/errata/RHSA-2024:0772
https://access.redhat.com/errata/RHSA-2024:0773
https://access.redhat.com/errata/RHSA-2024:1153
https://access.redhat.com/security/cve/CVE-2023-5824
https://bugzilla.redhat.com/show_bug.cgi?id=2245914
https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255
https://access.redhat.com/errata/RHSA-2023:7465

Get alerted when CVE-2023-5824 or the next vulnerability affects your stack