CVE-2024-23638: squid-cache squid Expired Pointer Dereference
Vulnerability summary
CVE-2024-23638 is a medium (CVSS 6.5) Expired Pointer Dereference vulnerability in squid-cache squid. EPSS estimates a 60.05% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 5Timeline
- 23-01-2024PublishedVulnerability first disclosed.
- 17-06-2025Last modifiedVulnerability information updated.
Description
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
60.05%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 60.05% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (megamansec.github.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-825Expired Pointer DereferenceThe product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
- CWE-672Operation on a Resource after Expiration or ReleaseThe product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Affected systems
Ubuntu2 products
- squid< 4.10-1ubuntu1.10 | < 5.7-0ubuntu0.22.04.4
- squid3All versions (No fix recorded)
Debian1 product
- squid< 5.7-2+deb12u1 | < 6.6-1
Squid-cache1 product
- squid< 6.6 | ≥ 5.0, ≤ 5.9 | ≥ 6.0, < 6.6
3 vendors · 4 products
References
13 links- github.com/squid-cache/squid/security/advisories/GHSA-j49p-553x-48rxX Refsource CONFIRMREPORTVendor Advisory
