CVE-2023-50269: squid-cache squid Uncontrolled Recursion

CVSS: 8.6v3.1HighModified

AliasesALPINE-CVE-2023-50269RHSA-2024:1085UBUNTU-CVE-2023-50269+1 more

Published 14-12-2023Last modified 21-05-2025

Vulnerability summary

CVE-2023-50269 is a high (CVSS 8.6) Uncontrolled Recursion vulnerability in squid-cache squid. EPSS estimates a 57.63% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.

Overall risk

46/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.6/10

010

High · v3.1 (CVE.org)

EPSS score

57.63%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 6

DLA-3709-1 DSA-5637-1 MGASA-2024-0102 OPENSUSE-SU-2024:13631-1 RHSA-2024:0397 RHSA-2024:0771+11 more

Timeline

14-12-2023
PublishedVulnerability first disclosed.
21-05-2025
Last modifiedVulnerability information updated.

Description

Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.

CVSS metrics

6 scores · 6 sources · 1 version

v3.18.6

EPSS trend

Probability

57.63%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 57.63% on 18-09-2026

18-09-202618-10-2026

EPSS score

57.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected systems

Redhat3 products

squid< 7:5.5-5.el9_2.4
squid-debuginfo< 7:5.5-5.el9_2.4
squid-debugsource< 7:5.5-5.el9_2.4

Ubuntu2 products

squid< 4.10-1ubuntu1.9 | < 5.7-0ubuntu0.22.04.3 | < 6.5-1ubuntu3
squid3< 3.5.12-1ubuntu7.16+esm3 | < 3.5.27-1ubuntu1.14+esm2

Alpine1 product

squid≥ 3.1, < 6.6-r0

Debian1 product

squid< 5.7-2+deb12u1 | < 6.6-1

Squid-cache1 product

squidEOL≥ 2.6, ≤ 2.7.STABLE9 | ≥ 6.0.1, < 6.6 | ≥ 3.1, ≤ 5.9 | ≥ 6.0.1, ≤ 6.5 | 2.6 | 2.7 | 2.7:stable1 | 2.7:stable2 | 2.7:stable3 | 2.7:stable4 | 2.7:stable5 | 2.7:stable6 | 2.7:stable7 | 2.7:stable8 | 2.7:stable9

5 vendors · 8 products