CVE-2025-54574 Squid's URN Handling can lead to Buffer Overflow
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-54574?
CVE-2025-54574 is a critical vulnerability in Squid-Cache Squid, published on 1 Aug 2025.
Official description
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
Which versions are affected by CVE-2025-54574?
It affects 1 product.
Products include Squid-Cache Squid.
How do I fix CVE-2025-54574?
Upgrade to a fixed version.
Is CVE-2025-54574 being exploited?
There is no known exploitation of CVE-2025-54574 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Squid-Cache Squid
- CVE-2025-62168 Squid vulnerable to information disclosure via authentication credential leakage in error handling
- CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling
- CVE-2026-32748 Squid has Denial of Service in ICP Response handling
- CVE-2023-50269 SQUID-2023:10 Denial of Service in HTTP Request parsing
- CVE-2023-49285 Denial of Service in HTTP Message Processing in Squid
Sources
Also known as AZL-66075, CLSA-2025-1757010850, CLSA-2025-1757014622, CLSA-2025-1757015024, CLSA-2025-1757015131, CLSA-2025-1757016520 and 6 more.