CVE-2025-54574: Squid's URN Handling can lead to Buffer Overflow

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 24.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-01 · updated 2026-06-17
Weakness: CWE-122

Description

Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.

Affected products

Squid: before 6.4 — fixed in 6.4

How to fix

Upgrade to a fixed version: Squid 6.4. Check the vendor advisory for mitigations.

References

https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
https://github.com/squid-cache/squid/releases/tag/SQUID_6_4
https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3
http://www.openwall.com/lists/oss-security/2025/11/05/5
https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html

Get alerted when CVE-2025-54574 or the next vulnerability affects your stack