The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before     caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing     a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in     a denial of service. (CVE-2023-5824)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-7053:06 advisory.

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016516 advisory.

    A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before     caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing     a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in     a denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the squid package has been released.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1021 advisory.

    This advisory aggregates security fixes for the squid SRPM in CIQ LTS 9.2. It addresses 6 CVEs:
    CVE-2024-25111, CVE-2023-5824, CVE-2024-25617, CVE-2023-46728, CVE-2023-46724, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0072 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0397 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (JIRA:RHEL-18256)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1153 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (RHEL-18248)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-578 advisory.

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are     subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding.
    All versions of Squid from 3.5 up to and including 5.9 configured with collapsed_forwarding on are     vulnerable. Configurations with collapsed_forwarding off or without a collapsed_forwarding directive     are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable     to upgrade should remove all collapsed_forwarding lines from their squid.conf. (CVE-2023-49288)

    SQUID-2023:2 Multiple issues in HTTP response caching (CVE-2023-5824)

    Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6     is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a     trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid     older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and     including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by     Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in     Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access     control: `http_access deny manager`. (CVE-2024-23638)

    Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable     to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This     problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP     Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the     stable releases can be found in Squid's patch archives. There is no workaround for this issue.
    (CVE-2024-25111)

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer     overflow and possible remote code execution attack when processing URN due to incorrect buffer management.
    This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
    (CVE-2025-54574)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7668 advisory.

  - Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling     of Structural Elements bug. (CVE-2023-5824)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-7668 advisory.

    - Fix squid: DoS against HTTP and HTTPS (CVE-2023-5824)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6728-1 advisory.

    Joshua Rogers discovered that Squid incorrectly handled collapsed forwarding. A remote attacker could     possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only     affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)

    Joshua Rogers discovered that Squid incorrectly handled certain structural elements. A remote attacker     could possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2023-5824)

    Joshua Rogers discovered that Squid incorrectly handled Cache Manager error responses. A remote trusted     client can possibly use this issue to cause Squid to crash, resulting in a denial of service.
    (CVE-2024-23638)

    Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked decoder. A remote attacker could     possibly use this issue to cause Squid to stop responding, resulting in a denial of service.
    (CVE-2024-25111)

    Joshua Rogers discovered that Squid incorrectly handled HTTP header parsing. A remote trusted client can     possibly use this issue to cause Squid to crash, resulting in a denial of service. (CVE-2024-25617)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0310 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-5824:
      Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper     Handling of Structural Elements bug.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0262 advisory.

    This advisory aggregates security fixes for the squid SRPM in CIQ LTS 8.6. It addresses 50 CVEs:
    CVE-2019-12520, CVE-2019-12524, CVE-2013-1839, CVE-2021-28116, CVE-2019-12529, and 45 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4312 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4312-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     September 27, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : squid     Version        : 4.13-10+deb11u5     CVE ID         : CVE-2023-5824 CVE-2023-46728 CVE-2025-54574     Debian Bug     : 1055249

    Three security issues were discovered in the Squid proxy caching server,     which could result in the execution of arbitrary code, information     disclosure or denial of service.

    CVE-2023-5824

        A flaw was found in Squid. The limits applied for validation of HTTP         response headers are applied before caching. However,         Squid may grow a cached HTTP response header beyond the configured         maximum size, causing a stall or crash of the worker process when a         large header is retrieved from the disk cache, resulting in a denial         of service.

    CVE-2023-46728

        Due to a NULL pointer dereference bug Squid is vulnerable to a         Denial of Service attack against Squid's Gopher gateway.
        The obsolete gopher protocol, even if non functional,         was always available and enabled.
        Responses triggering this bug are possible to be received         from any gopher server, even those without malicious intent.
        Gopher support (already non functional) has been removed to fix         this CVE.
        Note that gopher was deprecated and major browsers removed it,         long time ago.

    CVE-2025-54574

        Squid is vulnerable to a heap buffer overflow and possible remote         code execution (RCE) attack when processing URN due to incorrect         buffer management.

    For Debian 11 bullseye, these problems have been fixed in version     4.13-10+deb11u5.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7668 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
226110	Linux Distros Unpatched Vulnerability : CVE-2023-5824	Nessus	Misc.	2025/3/5	2026/7/25	high
293703	MiracleLinux 9 : squid-5.5-6.el9_3.2 (AXSA:2023-7053:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
313078	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: squid (UTSA-2026-016516)	Nessus	Unity Linux Local Security Checks	2026/5/7	2026/5/7	high
204419	Photon OS 5.0: Squid PHSA-2023-5.0-0154	Nessus	PhotonOS Local Security Checks	2024/7/24	2026/10/13	medium
356951	Rocky Linux 9.2 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource Multiple Vulnerabilities (ciqsa-2026_1021)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
187675	RHEL 9 : squid (RHSA-2024:0072)	Nessus	Red Hat Local Security Checks	2024/1/8	2025/8/27	critical
189652	RHEL 8 : squid:4 (RHSA-2024:0397)	Nessus	Red Hat Local Security Checks	2024/1/26	2025/8/27	critical
191572	RHEL 9 : squid (RHSA-2024:1153)	Nessus	Red Hat Local Security Checks	2024/3/5	2025/8/27	critical
192888	Amazon Linux 2023 : squid (ALAS2023-2024-578)	Nessus	Amazon Linux Local Security Checks	2024/4/3	2025/8/29	critical
186632	Rocky Linux 8 : squid:4 (RLSA-2023:7668)	Nessus	Rocky Linux Local Security Checks	2023/12/6	2023/12/12	high
186736	Oracle Linux 8 : squid:4 (ELSA-2023-7668)	Nessus	Oracle Linux Local Security Checks	2023/12/11	2025/9/9	high
193170	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Squid vulnerabilities (USN-6728-1)	Nessus	Ubuntu Local Security Checks	2024/4/10	2025/9/3	high
239376	TencentOS Server 3: squid:4 (TSSA-2023:0310)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	high
356925	Rocky Linux 8.6 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource Multiple Vulnerabilities (ciqsa-2026_0262)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/11	critical
266025	Debian dla-4312 : squid - security update	Nessus	Debian Local Security Checks	2025/9/27	2026/4/30	critical
186618	RHEL 8 : squid:4 (RHSA-2023:7668)	Nessus	Red Hat Local Security Checks	2023/12/6	2025/8/27	critical

检测

插件搜索

high

high

high

medium

high

critical

critical

critical

critical

high

high

high

high

critical

critical

critical