The rfc1738_do_escape function in ftp.c for Squid 2.5 STABLE11 and earlier allows remote FTP servers to cause a denial of service (segmentation fault) via certain "odd" responses.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0262 advisory.

    This advisory aggregates security fixes for the squid SRPM in CIQ LTS 8.6. It addresses 50 CVEs:
    CVE-2019-12520, CVE-2019-12524, CVE-2013-1839, CVE-2021-28116, CVE-2019-12529, and 45 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0495 advisory.

    This advisory aggregates security fixes for the squid SRPM in CIQ LTS 9.2. It addresses 25 CVEs:
    CVE-2024-45802, CVE-2024-23638, CVE-2013-0189, CVE-2013-1839, CVE-2019-12528, and 20 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1490 advisory.

    This advisory aggregates security fixes for the squid SRPM in CIQ LTS 9.6. It addresses 30 CVEs:
    CVE-2024-45802, CVE-2024-37894, CVE-2021-46784, CVE-2022-41318, CVE-2023-49286, and 25 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A Secunia Advisory reports :

M.A.Young has reported a vulnerability in Squid, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in handling certain FTP server responses. This can be exploited to crash Squid by visiting a malicious FTP server via the proxy.

The rfc1738_do_escape function in ftp.c for Squid 2.5.STABLE11 and earlier allows remote FTP servers to cause a denial of service (segmentation fault) via certain 'odd' responses.

The updated packages have been patched to address these issues.

ID	Name	Product	Family	Type	Severity
356925	Rocky Linux 8.6 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource Multiple Vulnerabilities (ciqsa-2026_0262)	Nessus	Rocky Linux Local Security Checks	Local	critical
355986	Rocky Linux 9.2 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource Multiple Vulnerabilities (ciqsa-2026_0495)	Nessus	Rocky Linux Local Security Checks	Local	critical
354425	Rocky Linux 9.6 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource Multiple Vulnerabilities (ciqsa-2026_1490)	Nessus	Rocky Linux Local Security Checks	Local	critical
21393	FreeBSD : squid -- FTP server response handling denial of service (1c3142a3-4ab2-11da-932d-00055d790c25)	Nessus	FreeBSD Local Security Checks	Local	medium
20123	Mandrake Linux Security Advisory : squid (MDKSA-2005:195)	Nessus	Mandriva Local Security Checks	Local	medium

Detections

Analytics

CVE-2005-3258

high

Tenable Plugins

critical

critical

critical

medium

medium