QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2023-50269

Back to search

CVE-2023-50269

Published: Dec 14, 2023

Modified: May 21, 2025

PUBLISHED

CVSS v3.1

8.6

HIGH

Description

Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.

VendorProductVersions

squid-cache

squid

affected
>= 2.6, <= 2.7.STABLE9
affected
>= 3.1, <= 5.9
affected
>= 6.0.1, < 6.6

Weaknesses (CWE)

CWE-674

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now