The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-7624:02 advisory.

    * squid: denial of service in HTTP header parser (CVE-2024-25617)
      * squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111)
      * squid: denial of service in HTTP request parsing (CVE-2023-50269)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ab77331a34 advisory.

    - New version 6.6
    - Important security fixes
    - Removed gopher support

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0397 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (JIRA:RHEL-18256)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0298-1 advisory.

  - Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through     2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial     of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of     Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is     configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. (CVE-2023-50269)

  - Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6     is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a     trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid     older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and     including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by     Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in     Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access     control: `http_access deny manager`. (CVE-2024-23638)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0296-1 advisory.

  - Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through     2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial     of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of     Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is     configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. (CVE-2023-50269)

  - Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6     is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a     trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid     older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and     including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by     Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in     Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access     control: `http_access deny manager`. (CVE-2024-23638)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1085 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1153 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18248)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1787 advisory.

    - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778)
    - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788)
    - Resolves: CVE-2021-31806,31807,31808 squid: Handle more Range requests (#790)
    - Resolves: CVE-2021-33620 squid: Handle more partial responses (#791)
    - Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol       code -- Remove support for Gopher protocol (CVE-2023-46728)
    - Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing       feature (CVE-2023-49285)
    - Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In       Helper Process management (CVE-2023-49286)
    - Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation       (CVE-2023-46724)
    - Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing       (CVE-2023-50269)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0081 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-50269:
    Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through     2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial     of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of     Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is     configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives.

    CVE-2024-25111:
    Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.

    CVE-2024-25617:
    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse     of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header     parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending     oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the     request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version     6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in     cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time     prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5.
    There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0117 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-50269:
    A flaw was found in Squid, which is susceptible to a Denial of Service (DoS) due to an Uncontrolled     Recursion bug, specifically targeting HTTP Request parsing. Exploiting this issue involves a remote client     initiating a DoS attack by sending an oversized X-Forwarded-For header when the follow_x_forwarded_for     feature is configured. This issue poses a threat to the stability and availability of the Squid service.

    CVE-2024-25111:
    A flaw was found in Squid. This issue may allow a remote attacker to trigger an uncontrolled recursion bug     when sending a specially crafted, chunked, encoded HTTP Message, resulting in a denial of service.

    CVE-2024-25617:
    A flaw was found in Squid. This issue may allow a remote client or remote server to trigger a denial of     service when sending oversized headers in HTTP messages.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
293139	MiracleLinux 9 : squid-5.5-6.el9_3.8 (AXSA:2024-7624:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
187385	Fedora 39 : squid (2023-ab77331a34)	Nessus	Fedora Local Security Checks	2023/12/28	2024/11/14	high
189652	RHEL 8 : squid:4 (RHSA-2024:0397)	Nessus	Red Hat Local Security Checks	2024/1/26	2025/8/27	critical
189931	SUSE SLES15 Security Update : squid (SUSE-SU-2024:0298-1)	Nessus	SuSE Local Security Checks	2024/2/2	2024/2/2	high
189937	SUSE SLES12 Security Update : squid (SUSE-SU-2024:0296-1)	Nessus	SuSE Local Security Checks	2024/2/2	2024/2/2	high
191538	RHEL 9 : squid (RHSA-2024:1085)	Nessus	Red Hat Local Security Checks	2024/3/5	2024/11/7	high
191572	RHEL 9 : squid (RHSA-2024:1153)	Nessus	Red Hat Local Security Checks	2024/3/5	2025/8/27	critical
193259	Oracle Linux 7 : squid (ELSA-2024-1787)	Nessus	Oracle Linux Local Security Checks	2024/4/12	2025/9/9	high
236065	Alibaba Cloud Linux 3 : 0081: squid:4 (ALINUX3-SA-2024:0081)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
238672	TencentOS Server 3: squid:4 (TSSA-2024:0117)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	high

检测

插件搜索

high

high

critical

high

high

high

critical

high

high

high