CVE-2024-37894: Squid vulnerable to heap corruption in ESI assign

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-25 · updated 2026-06-17
Weakness: CWE-787

Description

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

Affected products

Squid: from 3.0 before 6.10 — fixed in 6.10

How to fix

Upgrade to a fixed version: Squid 6.10. Check the vendor advisory for mitigations.

References

https://github.com/squid-cache/squid/commit/f411fe7d75197852f0e5ee85027a06d58dd8df4c.patch
https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg
https://security.netapp.com/advisory/ntap-20240719-0001/
https://github.com/squid-cache/squid/commit/f411fe7d75197852f0e5ee85027a06d58dd8df4c.patch
https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg
https://lists.debian.org/debian-lts-announce/2025/03/msg00009.html
https://security.netapp.com/advisory/ntap-20240719-0001/

Get alerted when CVE-2024-37894 or the next vulnerability affects your stack