CVE-2024-25111

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25111
Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch Mailing List Patch
https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ Mailing List
https://security.netapp.com/advisory/ntap-20240605-0001/ Third Party Advisory
http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch Mailing List Patch
https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ Mailing List
https://security.netapp.com/advisory/ntap-20240605-0001/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*
History

26 Feb 2025, 15:14

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
First Time Fedoraproject fedora
Netapp
Fedoraproject
Netapp bluexp
Squid-cache
Squid-cache squid
References () http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch - () http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch - Mailing List, Patch
References () https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc - () https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc - Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ - Mailing List
References () https://security.netapp.com/advisory/ntap-20240605-0001/ - () https://security.netapp.com/advisory/ntap-20240605-0001/ - Third Party Advisory

21 Nov 2024, 09:00

Type Values Removed Values Added
References () http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch - () http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch -
References () https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc - () https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ -
References () https://security.netapp.com/advisory/ntap-20240605-0001/ - () https://security.netapp.com/advisory/ntap-20240605-0001/ -

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240605-0001/ -

25 Apr 2024, 06:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWQHRDRHDM5PQTU6BHH4C5KGL37X6TVI/ -

06 Mar 2024, 21:42

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-06 19:15

Updated : 2025-04-10 17:44

NVD link : CVE-2024-25111

Mitre link : CVE-2024-25111

CVE.ORG link : CVE-2024-25111

JSON object : View

Products Affected

netapp

  • bluexp

fedoraproject

  • fedora

squid-cache

  • squid
CWE
CWE-674

Uncontrolled Recursion