CVE-2024-25111 - CVE House
Back to Database
Status published High CVE-2024-25111

SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

Vulnerability Description

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-25111

Credits & Attribution

No credits recorded in the NVD database.

References

More from squid-cache

View All →
CVE-2025-62168
Squid vulnerable to information disclosure via authentication credential leakage in error handling
Critical 10
CVE-2025-54574
Squid's URN Handling can lead to Buffer Overflow
Critical 9.3
CVE-2024-45802
Squid Denial of Service
High 7.5
CVE-2024-37894
Squid vulnerable to heap corruption in ESI assign
Medium 6.3
CVE-2024-25617
Denial of Service in HTTP Header parser in squid proxy
Medium 5.3

Affected Vendor

squid-cache

View all reports →

Affected Software

squid
Vulnerable Versions:
>= 3.5.27, < 6.8

Timeline

Official Publish: March 6th, 2024
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

CWE-674

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.