Critical buffer overflow flaw in Squid HTTP Proxy enables remote code execution
Take action: If you're running Squid proxy software, plan a quick upgrade to version 6.4 or later, because there's a flaw that can enable malicious websites to breach the Squid server. Check with your proxy vendors as well, you may not have direct access to the proxy in a commercial product.
Learn More
Squid has patched a critical security vulnerability that enabled remote code execution in the proxy software.
The flaw is tracked as CVE-2025-54574 (CVSS score 9.3), a heap buffer overflow vulnerability in the buffer management of Squid's URN (Uniform Resource Name) processing functionality. It enables remote servers to perform buffer overflow attacks when delivering URN Trivial-HTTP responses, allowing delivery of up to 4KB of Squid allocated heap memory to clients.
It allows remote attackers to potentially execute arbitrary code on affected systems and expose sensitive memory contents without requiring authentication or user interaction.
- Step 1: Target Identification An attacker identifies a vulnerable Squid proxy server (versions below 6.4) that processes URN requests. The attacker needs to be able to send HTTP responses to the proxy, typically by controlling a web server that the proxy might connect to.
- Step 2: Malicious URN Response The attacker crafts a specially malformed URN Trivial-HTTP response with oversized data that exceeds the expected buffer boundaries in Squid's URN processing code. This response exploits the incorrect buffer management to trigger a heap buffer overflow.
- Step 3: Memory Exposure/Code Execution When Squid processes the malicious URN response, the buffer overflow occurs, potentially allowing the attacker to:
- Read up to 4KB of heap memory containing sensitive data (credentials, tokens, etc.)
- In worst-case scenarios, achieve remote code execution on the proxy server
Affected versions of Squid:
- All Squid 4.x versions up to and including 4.17
- All Squid 5.x versions up to and including 5.9
- All Squid 6.x versions up to and including 6.3
- Squid versions older than 4.14 (untested but assumed vulnerable)
Versions that are not affected:
- Squid version 6.4 and later versions
Squid has patched this vulnerability in version 6.4, and patches for stable releases can be found in the project's patch archives.
Organizations should upgrade to Squid version 6.4 or later or to the patched versions of their stable release. For environments where immediate upgrading is not feasible, administrators can implement a temporary workaround by disabling URN access permissions in the configuration: add access control list rules to deny URN protocol requests: "acl URN proto URN" followed by "http_access deny URN", effectively blocking the vulnerable code path until proper patching can be completed.
