Overview 20 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 2 public PoC
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
3
15.0%
Not applicable
17
85.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
20
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
5.0%
Working exploit published
1
5.0%
Proof of concept only
2
10.0%
Forecast only
16
80.0%
No public exploit
0
0.0%
split by
peak 3 / year
20091
Not applicable1
Medium1
not blocked1
Forecast only1
20101
Not applicable1
Medium1
not blocked1
Forecast only1
20110
20120
20131
Not applicable1
Medium1
not blocked1
Working exploit published1
20142
Not applicable2
Medium2
not blocked2
Forecast only2
20150
20162
Not applicable2
High2
not blocked2
Forecast only2
20170
20180
20192
Not applicable2
High1
Medium1
not blocked2
Forecast only2
20201
Not applicable1
High1
not blocked1
Forecast only1
20213
Outside Waratek scope1
Not applicable2
Medium3
not blocked3
Forecast only3
20220
20233
Not applicable3
High3
not blocked3
Forecast only3
20243
Outside Waratek scope2
Not applicable1
High2
Medium1
not blocked3
Proof of concept only2
Forecast only1
20251
Not applicable1
Critical1
not blocked1
Exploited1
200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-62168 | Critical | 2025-10-17 | Not applicable | Exploited | Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off. |
| CVE-2024-25111 | High | 2024-03-06 | Outside Waratek scope | Proof of concept only | Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue. |
| CVE-2024-25617 | High | 2024-02-14 | Outside Waratek scope | Forecast only | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2 |
| CVE-2024-23638 | Medium | 2024-01-24 | Not applicable | Proof of concept only | Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`. |
| CVE-2023-50269 | High | 2023-12-14 | Not applicable | Forecast only | Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. |
| CVE-2023-49285 | High | 2023-12-04 | Not applicable | Forecast only | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2023-46847 | High | 2023-11-03 | Not applicable | Forecast only | Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. |
| CVE-2021-33620 | Medium | 2021-05-28 | Not applicable | Forecast only | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server. |
| CVE-2021-31806 | Medium | 2021-05-27 | Outside Waratek scope | Forecast only | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing. |
| CVE-2021-28662 | Medium | 2021-05-27 | Not applicable | Forecast only | An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic. |
| CVE-2020-8450 | High | 2020-02-04 | Not applicable | Forecast only | An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. |
| CVE-2019-12527 | High | 2019-07-11 | Not applicable | Forecast only | An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data. |
| CVE-2019-13345 | Medium | 2019-07-05 | Not applicable | Forecast only | The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. |
| CVE-2016-4553 | High | 2016-05-10 | Not applicable | Forecast only | client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. |
| CVE-2016-4054 | High | 2016-04-25 | Not applicable | Forecast only | Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. |
| CVE-2014-7141 | Medium | 2014-11-26 | Not applicable | Forecast only | The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet. |
| CVE-2014-3609 | Medium | 2014-09-11 | Not applicable | Forecast only | HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values." |
| CVE-2013-4123 | Medium | 2013-09-16 | Not applicable | Working exploit published | client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header. |
| CVE-2010-3072 | Medium | 2010-09-20 | Not applicable | Forecast only | The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request. |
| CVE-2009-2622 | Medium | 2009-07-28 | Not applicable | Forecast only | Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc. |