CVE-2023-49288 Denial of Service in HTTP Collapsed Forwarding in Squid

High 8.6 Published 4 Dec 2023 Updated 13 Feb 2025

A use-after-free bug in Squid's collapsed forwarding feature allows attackers to cause a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-49288?

CVE-2023-49288 is a high-severity use after free vulnerability in Squid-Cache Squid, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.

Weakness: CWE-416

Which versions are affected by CVE-2023-49288?

It affects 1 product.

Products include Squid-Cache Squid.

How do I fix CVE-2023-49288?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-49288 being exploited?

There is no known exploitation of CVE-2023-49288 in the wild and no public exploit code.

All Squid-Cache Squid vulnerabilities

Sources

Also known as ALPINE-CVE-2023-49288, AZL-32073, CLSA-2024-1714462008, CLSA-2024-1716272474, CLSA-2025-1741034026, CLSA-2026-1777539711 and 4 more.