CVE-2023-49288

    Dashboard / Vulnerabilities / CVE-2023-49288

    CVE-2023-49288

    Published: 4 Dec 2023Last Modified: 28 Oct 2026

    Summary: Denial of Service in HTTP Collapsed Forwarding in Squid

    Details: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.

    References: https://lists.fedoraproject.org/archives/list/[email protected]/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/, https://lists.fedoraproject.org/archives/list/[email protected]/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49288.json, https://github.com/squid-cache/squid/security/advisories/GHSA-rj5h-46j6-q2g5, https://nvd.nist.gov/vuln/detail/CVE-2023-49288, https://security.netapp.com/advisory/ntap-20240119-0006/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ef1e128ce5a9733ae57d6595806bb832de389446

    Affected versions

    6.0.0-20210527-master-snapshot
    6.0.0-20210525-master-snapshot
    6.0.0-20210524-master-snapshot
    6.0.0-20210523-master-snapshot
    6.0.0-20210522-master-snapshot

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-49288 | CVE-DB