// For flags

CVE-2024-37894

Squid vulnerable to heap corruption in ESI assign

Severity Score

6.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

Squid es un proxy de almacenamiento en caché para la Web que admite HTTP, HTTPS, FTP y más. Debido a un error de escritura fuera de los límites al asignar variables ESI, Squid es susceptible a un error de corrupción de memoria. Este error puede provocar un ataque de denegación de servicio.

A flaw was found in Squid. An out-of-bounds write can be triggered when an Edge Side Includes (ESI) variable is assigned to a value not in the standard ASCII range, for example, multi-byte characters. This flaw allows a trusted server to crash Squid while processing an ESI response content, resulting in a denial of service.

Joshua Rogers discovered that Squid did not properly handle multi-byte characters during Edge Side Includes processing. A remote attacker could possibly use this issue to cause a memory corruption error, leading to a denial of service.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-06-10 CVE Reserved
  • 2024-06-25 CVE Published
  • 2025-02-13 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-787: Out-of-bounds Write
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Squid-cache
Search vendor "Squid-cache"
 Squid
Search vendor "Squid-cache" for product "Squid"
 >= 3.0.0 <= 3.5.28
Search vendor "Squid-cache" for product "Squid" and version " >= 3.0.0 <= 3.5.28"
en
Affected
Squid-cache
Search vendor "Squid-cache"
 Squid
Search vendor "Squid-cache" for product "Squid"
 >= 4.0 <= 4.16
Search vendor "Squid-cache" for product "Squid" and version " >= 4.0 <= 4.16"
en
Affected
Squid-cache
Search vendor "Squid-cache"
 Squid
Search vendor "Squid-cache" for product "Squid"
 >= 5.0 <= 5.9
Search vendor "Squid-cache" for product "Squid" and version " >= 5.0 <= 5.9"
en
Affected
Squid-cache
Search vendor "Squid-cache"
 Squid
Search vendor "Squid-cache" for product "Squid"
 >= 6.0 <= 6.9
Search vendor "Squid-cache" for product "Squid" and version " >= 6.0 <= 6.9"
en
Affected