CVE-2023-46728 - CVE House

Back to Database

Status published High CVE-2023-46728

SQUID-2021:8 Denial of Service in Gopher gateway

7.5 CVSS

Vulnerability Description

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46728

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from squid-cache

View All →

Squid vulnerable to information disclosure via authentication credential leakage in error handling

Squid's URN Handling can lead to Buffer Overflow

Squid Denial of Service

Squid vulnerable to heap corruption in ESI assign

Denial of Service in HTTP Header parser in squid proxy

Affected Vendor

squid-cache

View all reports →

Affected Software

squid

Vulnerable Versions:

< 6.0.1

Timeline

Official Publish: November 6th, 2023

Last Modified: November 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1499.004 Application or System Exploitation

T1489 Service Stop

T1203 Exploitation for Client Execution

T1190 Exploit Public-Facing Application