CVE-2024-25617

MEDIUM
Published Feb 14, 2024 Modified Jun 25, 2025 CWE-182 CWE-400

Description

Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2

Is your site exposed to CVE-2024-25617?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness Type (CWE)

CWE-182 CWE-182
CWE-400 Uncontrolled Resource Consumption

Affected Products

Vendor Product
squid-cache squid
netapp bluexp

References

Frequently Asked Questions

What is CVE-2024-25617? +
Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2 It has a CVSS v3.1 base score of 5.3 (MEDIUM).
How severe is CVE-2024-25617? +
CVE-2024-25617 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-25617? +
CVE-2024-25617 affects products from netapp, squid-cache, specifically: bluexp, squid. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-25617? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-62168 10.0

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication …
CVE-2025-54574 9.3

Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer …
CVE-2024-25111 8.6

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to …
CVE-2024-45802 7.5

Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, …
CVE-2026-47729 6.5

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of …
CVE-2024-23638 6.5

Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-25617 — free, no signup required.