Latest Squid caching proxy vulnerability: CVE-2025-62168 #
Squid has disclosed an information disclosure vulnerability in certain versions of the Squid caching proxy via generated error messages returned to clients. The flaw results from a failure to redact sensitive information such as HTTP authentication credentials from error message %R and %W code expansions. This could be exploited through a script to bypass browser security protections and discover the credentials a trusted client uses to authenticate. Successful exploitation may allow a remote, unauthenticated adversary to identify security credentials or tokens used internally by web applications using Squid for backend load balancing. Such an attack does not require Squid to be configured with HTTP authentication. This vulnerability has been designated CVE-2025-62168 and has been rated critical with a CVSS score of 10.0.
The vulnerability depends on the email_err_data configuration value. All Squid versions up to and including 7.1 configured without email_err_data or with email_err_data on are vulnerable, since email_err_data defaults to on. All Squid versions configured with email_err_data off are not vulnerable. The patch code changes appear to indicate a possibility that sensitive information could be leaked via HTTP TRACE responses as well, but this has not been verified.
The following versions are affected
- Squid 3.x versions up to and including 3.5.28
- Squid 4.x versions up to and including 4.17
- Squid 5.x versions up to and including 5.9
- Squid 6.x versions up to and including 6.14
- Squid 7.x versions up to and including 7.1
What is Squid caching proxy? #
Squid caching proxy is a versatile open-source proxy server that enhances web performance by caching and reusing frequently requested web pages and filtering traffic to enforce access policies.
What is the impact? #
Successful exploitation of the vulnerability would allow an adversary to identify security credentials or tokens used internally by web applications using Squid for backend load balancing.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Squid 7.x upgrade to version 7.2 or later
- For all other stable releases upgrade to the latest patch version available in the patch archives
If you are using a prepackaged version of Squid, refer to your package vendor for information on the availability of updated packages.
Workaround: Mitigate the vulnerability by disabling the generated debug information in administrator mailto links within error messages through the following configuration change:
email_err_data offHow to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:="Squid Cache" AND product:=Squid AND (version:>0 AND version:<7.2)August 2025: CVE-2025-54574 #
Squid has disclosed a heap-based buffer overflow vulnerability in certain versions of the Squid caching proxy due to incorrect buffer management when processing a Uniform Resource Name (URN). This vulnerability allows a remote server to perform a buffer overflow attack by delivering specially crafted URN Trivial-HTTP responses. Successful exploitation may lead to remote code execution (RCE) or the disclosure of up to 4KB of data from Squid's allocated heap memory. This leaked memory may contain security credentials or other confidential data. This vulnerability has been designated CVE-2025-54574 and has been rated critical with a CVSS score of 9.3.
The following versions are affected
- Squid 2.x versions up to and including 2.7.STABLE9
- Squid 3.x versions up to and including 3.5.28
- Squid 4.x versions up to and including 4.17
- Squid 5.x versions up to and including 5.9
- Squid 6.x versions up to and including 6.3
What is the impact? #
Successful exploitation of the vulnerability would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Squid 6.x upgrade to version 6.4 or later
- For all other stable releases upgrade to the latest patch version available in the patch archives
If you are using a prepackaged version of Squid, refer to your package vendor for information on the availability of updated packages.
Workaround: Mitigate the vulnerability by disabling URN access permissions through adding the following configuration changes:
acl URN proto URN
http_access deny URNHow to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:"Squid Cache" and product:"Squid" and version:<6.4
