Denial of Service in HTTP Collapsed Forwarding in Squid

CVE-2023-49288

What is CVE-2023-49288?

The Squid caching proxy is affected by a Use-After-Free vulnerability that can enable a Denial of Service attack when 'collapsed_forwarding' is enabled. This issue impacts all Squid versions from 3.5 up to and including 5.9. Users with 'collapsed_forwarding on' configuration are at risk, but those with 'collapsed_forwarding off' or lacking this directive are not vulnerable. It is recommended that users upgrade to Squid version 6.0.1 immediately to mitigate this vulnerability. Alternatively, users unable to upgrade should edit their squid.conf to remove any 'collapsed_forwarding' settings.

References