CVE-2023-49285: squid-cache squid Buffer Over-read
CVSS: 8.6v3.1HighModified
AliasesALPINE-CVE-2023-49285UBUNTU-CVE-2023-49285DEBIAN-CVE-2023-49285
Published 04-12-2023Last modified 13-02-2025
Vulnerability summary
CVE-2023-49285 is a high (CVSS 8.6) Buffer Over-read vulnerability in squid-cache squid. EPSS estimates a 88.14% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.
CVSS score
8.6/10
010
High · v3.1 (CVE.org)EPSS score
88.14%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 18 · Related 6Timeline
- 04-12-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 8.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HSources5 sources · 7.5–8.6
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
88.14%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 88.14% on 18-09-2026
18-09-202618-10-2026
EPSS score88.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- squid< 4.10-1ubuntu1.9 | < 5.7-0ubuntu0.22.04.3 | < 6.5-1ubuntu1
- squid3< 3.5.12-1ubuntu7.16+esm3 | < 3.5.27-1ubuntu1.14+esm2
Alpine1 product
- squid< 6.5-r0
Debian1 product
- squid< 5.7-2+deb12u1 | < 6.5-1
Squid-cache1 product
- squid≥ 2.2, < 6.5 | ≤ 6.4
4 vendors · 5 products
References
16 links- github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9X Refsource CONFIRMREPORTVendor Advisory
