CVE-2023-46728

Name of the Vulnerable Software and Affected Versions Squid versions prior to 6.0.1

Description The issue is related to a NULL pointer dereference bug in Squid's Gopher gateway, making it vulnerable to a Denial of Service attack. The gopher protocol is always available and enabled in Squid prior to version 6.0.1. Responses that trigger this bug can be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1.

Recommendations For Squid versions prior to 6.0.1, users are advised to upgrade to version 6.0.1 or later to resolve the issue. As a temporary workaround for users unable to upgrade, reject all gopher URL requests to minimize the risk of exploitation.