CVE-2024-25111

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
squid-cache	squid	>= 3.5.27, < 6.8
netapp	bluexp	< *
squid-cache	squid	>= 3.5.27, < 6.8
fedoraproject	fedora	38
fedoraproject	fedora	39

References

Timeline

Published: Mar 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-251125.0Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-servi CVE-2024-251145.3Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a se CVE-2024-251157.0RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially CVE-2024-251165.5RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, authentica CVE-2024-251179.8php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that f CVE-2024-251186.5TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the edit CVE-2024-251194.9TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encrypt CVE-2024-251204.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be u CVE-2024-251217.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the Fi CVE-2024-251226.1sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially craf CVE-2024-251237.5MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a m CVE-2024-251249.8Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potential