CVE-2024-25617

Summary

CVE-2024-25617 is a Denial of Service vulnerability affecting the open-source caching proxy Squid. The issue stems from a Collapse of Data into Unsafe Value bug in HTTP header parsing, permitting remote clients or servers to initiate a Denial of Service attack. This vulnerability is significant as it can be exploited with oversized headers in HTTP messages, and versions of Squid prior to 6.5 are particularly susceptible if request_header_max_size or reply_header_max_size settings remain at their default values. Squid versions 6.5 and above come with a safer default setting, but administrators are still advised to upgrade to mitigate this risk. No known workarounds or patches are currently available for this vulnerability, which is also known as SQUID-2024:2.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.