Squid: denial of service in http digest authentication

Summary

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

Timeline

1. Nov 3, 2023, 7:58 AM UTCCVE published
2. Aug 7, 2026, 1:10 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• squid

  From 3.2.0.1 · fixed in 6.4

• squid34

  Version range not reported

• squid

  Version range not reported

• squid

  Version range not reported

• squid

  Version range not reported

• squid

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid:4

  Version range not reported

• squid

  Version range not reported

• squid

  Version range not reported

• squid

  Version range not reported

References 17