Squid Cache CVE-2025-62168

Exploitation requires that the attacker can elicit an error page or TRACE/trace reply from Squid whose generated body includes the original client request headers; pre-fix code in client_side_reply.cc, errorpage.cc, and HttpRequest::pack() emitted those headers (and Authorization data) without masking. Realistic disclosure is limited by whether credential-bearing or otherwise sensitive headers are actually present in the triggering request/transaction and whether the attacker receives the resulting response. The email_err_data directive (default 'on' before Squid 7.2, changed to 'off') governs inclusion of such data in error reports, so deployments on older versions or with email_err_data explicitly enabled are more exposed; the upstream fix additionally masks authorization data unconditionally. Affects Squid proxies reachable over the network (AV:N, PR:N), with no user interaction needed.

This is a credible, above-average-priority information disclosure flaw (CWE-209) rather than a high-CVSS paper tiger. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) is internally consistent: remote, unauthenticated, low-complexity, and confidentiality-only impact, which matches the commit evidence showing that Squid error pages and TRACE replies packed full request headers - including Authorization/credential data - without masking. Corroborating signals strengthen this: a public Nuclei detection/exploit template exists (POC=YES) and EPSS is 12.69% at the 94th percentile, unusually high and indicating real scanning/exploitation interest. However, the flaw is NOT on CISA KEV, so there is no confirmed active exploitation - POC availability must not be conflated with in-the-wild use. The main tension is between the high EPSS percentile (which reflects a widely scanned, internet-facing product) and the fact that the actual sensitive-data leak depends on whether error/TRACE responses reach an attacker and whether credential-bearing headers are present; EPSS likely overstates guaranteed impact because successful disclosure is opportunistic. Net: patch promptly on internet-facing Squid, but treat impact as sensitive-data exposure, not code execution.

An unauthenticated remote attacker sends requests through or to a vulnerable Squid proxy that trigger an error response (or a TRACE request), causing Squid to embed the original request headers - potentially including Authorization credentials and internal transaction/environment details - in the returned error or trace body. A public Nuclei template (CVE-2025-62168.yaml) automates detection of this leakage, and because the attack is network-based and low-complexity, it can be probed at scale against exposed proxies.