CVE-2023-50269 SQUID-2023:10 Denial of Service in HTTP Request parsing
Remote attackers can cause a denial of service in Squid proxy by sending large X-Forwarded-For headers when follow_x_forwarded_for is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50269?
CVE-2023-50269 is a high-severity denial of service vulnerability in Squid-Cache Squid, published on 14 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.
Weakness: CWE-674
Which versions are affected by CVE-2023-50269?
It affects 1 product.
Linux distribution packages (3)
squid Red Hat:rhel_eus:9.2::appstream | All versions | 7:5.5-5.el9_2.4 |
squid-debuginfo Red Hat:rhel_eus:9.2::appstream | All versions | 7:5.5-5.el9_2.4 |
squid-debugsource Red Hat:rhel_eus:9.2::appstream | All versions | 7:5.5-5.el9_2.4 |
Products include Squid-Cache Squid.
How do I fix CVE-2023-50269?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-50269 being exploited?
There is no known exploitation of CVE-2023-50269 in the wild and no public exploit code.
Other vulnerabilities in Squid-Cache Squid
- CVE-2025-62168 Squid vulnerable to information disclosure via authentication credential leakage in error handling
- CVE-2025-54574 Squid's URN Handling can lead to Buffer Overflow
- CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling
- CVE-2026-32748 Squid has Denial of Service in ICP Response handling
- CVE-2023-49285 Denial of Service in HTTP Message Processing in Squid
Sources
Also known as ALPINE-CVE-2023-50269, AZL-32251, CLSA-2024-1706026202, CLSA-2024-1706026402, CLSA-2024-1706026564, CLSA-2024-1706026686 and 10 more.