Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741034026 advisory.

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777054556 advisory.

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777054556 advisory.

  - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of     internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS     request to an internal cache manager URL. This is fixed in 5.7. (CVE-2022-41317)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2023_7668 advisory.

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777544744 advisory.

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016517 advisory.

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are
    subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are
    vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive
    are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable
    to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6728-3 advisory.

    USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused Squid to crash in certain     environments on Ubuntu 20.04 LTS and was disabled in USN-6728-2. The problematic fix for CVE-2023-5824 has     now been corrected and reinstated in this update.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6728-1 advisory.

    Joshua Rogers discovered that Squid incorrectly handled collapsed forwarding. A remote attacker could     possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only     affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)

    Joshua Rogers discovered that Squid incorrectly handled certain structural elements. A remote attacker     could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-5824)

    Joshua Rogers discovered that Squid incorrectly handled Cache Manager error responses. A remote trusted     client can possibly use this issue to cause Squid to crash, resulting in a denial of service.
    (CVE-2024-23638)

    Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked decoder. A remote attacker could     possibly use this issue to cause Squid to stop responding, resulting in a denial of service.
    (CVE-2024-25111)

    Joshua Rogers discovered that Squid incorrectly handled HTTP header parsing. A remote trusted client can     possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2024-25617)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-578 advisory.

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

    SQUID-2023:2 Multiple issues in HTTP response caching (CVE-2023-5824)

    Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6     is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a     trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid     older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and     including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by     Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in     Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access     control: `http_access deny manager`. (CVE-2024-23638)

    Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.
    (CVE-2024-25111)

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer     overflow and possible remote code execution attack when processing URN due to incorrect buffer management.
    This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
    (CVE-2025-54574)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6317eaa767 advisory.

    - New version 6.6
    - Important security fixes
    - Removed gopher support

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ab77331a34 advisory.

    - New version 6.6
    - Important security fixes
    - Removed gopher support

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7668 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7465 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
361650	AlmaLinux 9.2 [TuxCare] Security Update: squid (ALMALINUX9.2:CLSA-2025:1741034026)	Nessus	Alma Linux Local Security Checks	Local	high
360886	AlmaLinux 9.6 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777054556)	Nessus	Alma Linux Local Security Checks	Local	medium
360695	Rocky Linux 9.6 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777054556)	Nessus	Rocky Linux Local Security Checks	Local	medium
354064	Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc Multiple Vulnerabilities (crlsa-2023_7668)	Nessus	Rocky Linux Local Security Checks	Local	critical
352639	CentOS Linux 7 [TuxCare] Security Update: squid / squid-migration-script / squid-sysvinit (CENTOS7:CLSA-2026:1777544744)	Nessus	CentOS Local Security Checks	Local	high
313075	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: squid (UTSA-2026-016517)	Nessus	Unity Linux Local Security Checks	Local	high
424530	Alpine: multiple squid packages: security update to 6.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
424530	Alpine: multiple squid packages: security update to 6.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
226560	Linux Distros Unpatched Vulnerability : CVE-2023-49288	Nessus	Misc.	Local	high
193789	Ubuntu 20.04 LTS : Squid vulnerability (USN-6728-3)	Nessus	Ubuntu Local Security Checks	Local	high
193170	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Squid vulnerabilities (USN-6728-1)	Nessus	Ubuntu Local Security Checks	Local	high
192888	Amazon Linux 2023 : squid (ALAS2023-2024-578)	Nessus	Amazon Linux Local Security Checks	Local	critical
187386	Fedora 38 : squid (2023-6317eaa767)	Nessus	Fedora Local Security Checks	Local	high
187385	Fedora 39 : squid (2023-ab77331a34)	Nessus	Fedora Local Security Checks	Local	high
186618	RHEL 8 : squid:4 (RHSA-2023:7668)	Nessus	Red Hat Local Security Checks	Local	critical
186195	RHEL 9 : squid (RHSA-2023:7465)	Nessus	Red Hat Local Security Checks	Local	critical

Detections

Analytics

CVE-2023-49288

high

Tenable Plugins

high

medium

medium

critical

high

high

high

high

high

high

high

critical

high

high

critical

critical