10

CVE-2025-62168: squid-cache squid

CVSS: 10.0v3.1CriticalModified
AliasesALPINE-CVE-2025-62168SUSE-SU-2025:3902-1SUSE-SU-2025:4026-1
Published 17-10-2025Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2025-62168 is a critical (CVSS 10.0) vulnerability in squid-cache squid. EPSS estimates a 63.36% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
63.36%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 2
DLA-4369-1MGASA-2026-0094OPENSUSE-SU-2026:20027-1SUSE-SU-2026:20078-1

Timeline

  1. 17-10-2025
    PublishedVulnerability first disclosed.
  2. 26-02-2026
    Last modifiedVulnerability information updated.

Description

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

63.36%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 63.36% on 19-09-2026

19-09-202619-10-2026
EPSS score
63.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse18 products
  • squid&distro=SUSE Enterprise Storage 7.1< 4.17-150000.5.58.1
  • squid&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 4.17-150000.5.58.1
  • squid&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 5.7-150400.3.38.2
  • squid&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 5.7-150400.3.38.2
  • squid&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 5.7-150400.3.38.2
Redhat7 products
  • libecap< 0:1.0.1-2.module+el8.9.0+19703+a1da7223 | < 0:1.0.1-2.module+el8.1.0+4044+36416a77
  • libecap-debuginfo< 0:1.0.1-2.module+el8.9.0+19703+a1da7223 | < 0:1.0.1-2.module+el8.1.0+4044+36416a77
  • libecap-debugsource< 0:1.0.1-2.module+el8.9.0+19703+a1da7223 | < 0:1.0.1-2.module+el8.1.0+4044+36416a77
  • libecap-devel< 0:1.0.1-2.module+el8.9.0+19703+a1da7223 | < 0:1.0.1-2.module+el8.1.0+4044+36416a77
  • squid< 7:4.15-10.module+el8.10.0+23592+d564ec65.9 | < 7:5.5-5.el9_2.10 | < 7:5.5-13.el9_4.4 | < 7:5.2-1.el9_0.9 | < 7:3.5.20-17.el7_9.15 | < 7:4.15-3.module+el8.6.0+23600+226c63ed.8 | < 7:4.15-6.module+el8.8.0+23607+473e38b5.8 | < 7:4.4-8.module+el8.2.0+23601+6cdb820c.11 | < 7:5.5-22.el9_7.1 | < 7:6.10-6.el10_1.1 | < 7:6.10-5.el10_0.1 | < 7:5.5-19.el9_6.2 | < 7:4.11-4.module+el8.4.0+23593+1fc48abe.10
Opensuse2 products
  • squid&distro=openSUSE Leap 15.6< 6.10-150600.3.14.1
  • squid&distro=openSUSE Tumbleweed< 7.3-1.1
Ubuntu2 products
  • squid< 4.10-1ubuntu1.13+esm1 | < 5.9-0ubuntu0.22.04.4 | < 6.13-0ubuntu0.24.04.3 | < 6.13-1ubuntu4.1
  • squid3< 3.5.12-1ubuntu7.16+esm5 | < 3.5.27-1ubuntu1.14+esm4
Alpine1 product
  • squid< 7.3-r0
Debian1 product
  • squid< 7.2-1 | < 5.7-2+deb12u4 | < 6.13-2+deb13u1
Squid-cache1 product

7 vendors · 32 products

References

45 links
Show all 45 references