Squid
Monthly
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 33.2%.
Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Information disclosure in Squid Cache allows remote, unauthenticated attackers to obtain sensitive request data - including Authorization credentials - because pre-fix error page generation and TRACE handling echoed the original client request headers back into the response body without masking. Any deployment running an unpatched Squid build (CPE cpe:2.3:a:squid-cache:squid:*; Alpine Linux package fixed in 7.3-r0) that can be reached over the network and made to produce an error page or trace reply is exposed, and the exposure grows where the email_err_data directive is enabled or where legacy versions predate its switch to 'off'. Publicly available exploit code exists (a Nuclei detection template) and EPSS is elevated at 12.69% (94th percentile), which combined with CVSS 7.5 and full confidentiality impact makes prompt patching worthwhile, although there is no confirmed active exploitation (CISA KEV).
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 33.2%.
Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Information disclosure in Squid Cache allows remote, unauthenticated attackers to obtain sensitive request data - including Authorization credentials - because pre-fix error page generation and TRACE handling echoed the original client request headers back into the response body without masking. Any deployment running an unpatched Squid build (CPE cpe:2.3:a:squid-cache:squid:*; Alpine Linux package fixed in 7.3-r0) that can be reached over the network and made to produce an error page or trace reply is exposed, and the exposure grows where the email_err_data directive is enabled or where legacy versions predate its switch to 'off'. Publicly available exploit code exists (a Nuclei detection template) and EPSS is elevated at 12.69% (94th percentile), which combined with CVSS 7.5 and full confidentiality impact makes prompt patching worthwhile, although there is no confirmed active exploitation (CISA KEV).