CVE-2023-49288

Name of the Vulnerable Software and Affected Versions Squid versions 3.5 through 5.9

Description Squid is a caching proxy for the Web that supports HTTP, HTTPS, FTP, and more. The affected versions of Squid are subject to a Use-After-Free bug, which can lead to a Denial of Service attack via collapsed forwarding. This issue arises when Squid is configured with "collapsed forwarding on". Configurations with "collapsed forwarding off" or without a "collapsed forwarding" directive are not vulnerable.

Recommendations For Squid versions 3.5 through 5.9, users are advised to upgrade to version 6.0.1 to fix the bug. For users unable to upgrade, it is recommended to remove all collapsed forwarding lines from their squid.conf as a temporary workaround.