CVE-2024-23638 SQUID-2023:11 Denial of Service in Cache Manager
A trusted client can cause a denial of service in Squid proxy by exploiting an expired pointer reference in Cache Manager error responses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23638?
CVE-2024-23638 is a medium-severity use after free vulnerability in Squid-Cache Squid, published on 23 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
Which versions are affected by CVE-2024-23638?
It affects 1 product.
Products include Squid-Cache Squid.
How do I fix CVE-2024-23638?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-23638 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23638 exists.
Other vulnerabilities in Squid-Cache Squid
- CVE-2025-62168 Squid vulnerable to information disclosure via authentication credential leakage in error handling
- CVE-2025-54574 Squid's URN Handling can lead to Buffer Overflow
- CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling
- CVE-2026-32748 Squid has Denial of Service in ICP Response handling
- CVE-2023-50269 SQUID-2023:10 Denial of Service in HTTP Request parsing
Sources
Also known as AZL-34001, CLSA-2024-1733142081, CLSA-2024-1733142094, CLSA-2024-1734542622, DEBIAN-CVE-2024-23638, GHSA-j49p-553x-48rx and 3 more.