CVE-2024-23638 - CVE House

Back to Database

Status published Medium CVE-2024-23638

SQUID-2023:11 Denial of Service in Cache Manager

6.5 CVSS

Vulnerability Description

Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-23638

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from squid-cache

View All →

Squid vulnerable to information disclosure via authentication credential leakage in error handling

Squid's URN Handling can lead to Buffer Overflow

Squid Denial of Service

Squid vulnerable to heap corruption in ESI assign

Denial of Service in HTTP Header parser in squid proxy

Affected Vendor

squid-cache

View all reports →

Affected Software

squid

Vulnerable Versions:

< 6.6

Timeline

Official Publish: January 23rd, 2024

Last Modified: June 17th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.