Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the Ubuntu CVE-2025-54574 page.

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer     overflow and possible remote code execution attack when processing URN due to incorrect buffer     management. This has been fixed in version 6.4. To work around this issue, disable     URN access permissions.

    Ths commit to fix this issue is the same commit that fixed CVE-2023-5824 in USN-6728-1, USN-6728-2,     and USN-6728-3. See CVE-2023-5824 for additional commits.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-252c9276b3 advisory.

    - security fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f0452df4e2 advisory.

    - security fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-14414 advisory.

    - Fixes CVE-2025-54574, add URN access disabling config options [Orabug: 38350105]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4312 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4312-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     September 27, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : squid     Version        : 4.13-10+deb11u5     CVE ID         : CVE-2023-5824 CVE-2023-46728 CVE-2025-54574     Debian Bug     : 1055249

    Three security issues were discovered in the Squid proxy caching server,     which could result in the execution of arbitrary code, information     disclosure or denial of service.

    CVE-2023-5824

        A flaw was found in Squid. The limits applied for validation of HTTP         response headers are applied before caching. However,         Squid may grow a cached HTTP response header beyond the configured         maximum size, causing a stall or crash of the worker process when a         large header is retrieved from the disk cache, resulting in a denial         of service.

    CVE-2023-46728

        Due to a NULL pointer dereference bug Squid is vulnerable to a         Denial of Service attack against Squid's Gopher gateway.
        The obsolete gopher protocol, even if non functional,         was always available and enabled.
        Responses triggering this bug are possible to be received         from any gopher server, even those without malicious intent.
        Gopher support (already non functional) has been removed to fix         this CVE.
        Note that gopher was deprecated and major browsers removed it,         long time ago.

    CVE-2025-54574

        Squid is vulnerable to a heap buffer overflow and possible remote         code execution (RCE) attack when processing URN due to incorrect         buffer management.

    For Debian 11 bullseye, these problems have been fixed in version     4.13-10+deb11u5.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14414 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: denial of service in URN processing (CVE-2021-28651)

    * squid-cache: Squid Buffer Overflow (CVE-2025-54574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5982 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5982-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 21, 2025                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : squid     CVE ID         : CVE-2023-5824 CVE-2025-54574

    Two security issues were discovered in the Squid proxy caching server,     which could result in the execution of arbitrary code, information     disclosure or denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 5.7-2+deb12u3.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer     overflow and possible remote code execution attack when processing URN due to incorrect buffer management.
    This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
    (CVE-2025-54574)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version number,the version of Squid installed on the remote host is 5.x < 5.0.4 or prior to 4.13. It is, therefore, affected by a heap buffer overflow and possible remote code execution attack when processing URN.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-578 advisory.

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

    SQUID-2023:2 Multiple issues in HTTP response caching (CVE-2023-5824)

    Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6     is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a     trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid     older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and     including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by     Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in     Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access     control: `http_access deny manager`. (CVE-2024-23638)

    Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.
    (CVE-2024-25111)

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer     overflow and possible remote code execution attack when processing URN due to incorrect buffer management.
    This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
    (CVE-2025-54574)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1153 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18248)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0771 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18255)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0773 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0772 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18253)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0397 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (JIRA:RHEL-18256)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0072 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7668 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7465 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
272117	Ubuntu 20.04 LTS / 22.04 LTS : Squid vulnerabilities (CVE-2025-54574)	Nessus	Ubuntu Local Security Checks	critical
271704	Fedora 41 : squid (2025-252c9276b3)	Nessus	Fedora Local Security Checks	critical
271502	Fedora 42 : squid (2025-f0452df4e2)	Nessus	Fedora Local Security Checks	critical
266142	Oracle Linux 7 : squid (ELSA-2025-14414)	Nessus	Oracle Linux Local Security Checks	critical
266025	Debian dla-4312 : squid - security update	Nessus	Debian Local Security Checks	critical
254409	RHEL 7 : squid (RHSA-2025:14414)	Nessus	Red Hat Local Security Checks	high
253521	Debian dsa-5982 : squid - security update	Nessus	Debian Local Security Checks	high
251576	Linux Distros Unpatched Vulnerability : CVE-2025-54574	Nessus	Misc.	critical
114931	Squid < 6.4 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
192888	Amazon Linux 2023 : squid (ALAS2023-2024-578)	Nessus	Amazon Linux Local Security Checks	critical
191572	RHEL 9 : squid (RHSA-2024:1153)	Nessus	Red Hat Local Security Checks	critical
190404	RHEL 8 : squid:4 (RHSA-2024:0771)	Nessus	Red Hat Local Security Checks	critical
190403	RHEL 8 : squid:4 (RHSA-2024:0773)	Nessus	Red Hat Local Security Checks	critical
190402	RHEL 8 : squid:4 (RHSA-2024:0772)	Nessus	Red Hat Local Security Checks	critical
189652	RHEL 8 : squid:4 (RHSA-2024:0397)	Nessus	Red Hat Local Security Checks	critical
187675	RHEL 9 : squid (RHSA-2024:0072)	Nessus	Red Hat Local Security Checks	critical
186618	RHEL 8 : squid:4 (RHSA-2023:7668)	Nessus	Red Hat Local Security Checks	critical
186195	RHEL 9 : squid (RHSA-2023:7465)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2025-54574

critical

Tenable Plugins

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical