{"id":"CVE-2023-46848","state":"PUBLISHED","title":"Squid: denial of service in ftp","description":"Squid is vulnerable to Denial of Service,  where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.","publishedAt":"2023-11-03T07:58:05.613Z","updatedAt":"2026-02-25T18:19:24.166Z","severity":{"score":8.6,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["squid","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8"],"affected":[{"packageName":"squid","defaultStatus":"unaffected","versions":[{"version":"5.0.3","status":"affected","lessThan":"6.4","versionType":"semver"}],"collectionURL":"https://github.com/squid-cache/squid"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.5-5.el9_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.5-6.el9_3.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.2-1.el9_0.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"squid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"squid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"squid:4/squid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]}],"references":["https://access.redhat.com/errata/RHSA-2023:6266","https://access.redhat.com/errata/RHSA-2023:6268","https://access.redhat.com/errata/RHSA-2023:6748","https://access.redhat.com/security/cve/CVE-2023-46848","https://bugzilla.redhat.com/show_bug.cgi?id=2245919","https://github.com/squid-cache/squid/security/advisories/GHSA-2g3c-pg7q-g59w","https://security.netapp.com/advisory/ntap-20231214-0005/"],"weaknesses":["CWE-681"],"ingestedAt":"2026-10-29T20:06:24.729Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/46xxx/CVE-2023-46848.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-46848","state":"PUBLISHED","datePublished":"2023-11-03T07:58:05.613Z","dateUpdated":"2026-02-25T18:19:24.166Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-10-27T08:36:38.158Z"},"containers":{"cna":{"title":"Squid: denial of service in ftp","descriptions":[{"lang":"en","value":"Squid is vulnerable to Denial of Service,  where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input."}],"affected":[{"packageName":"squid","defaultStatus":"unaffected","versions":[{"version":"5.0.3","status":"affected","lessThan":"6.4","versionType":"semver"}],"collectionURL":"https://github.com/squid-cache/squid"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.5-5.el9_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.5-6.el9_3.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.2-1.el9_0.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"squid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"squid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"squid:4/squid","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6266","name":"RHSA-2023:6266","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6268","name":"RHSA-2023:6268","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6748","name":"RHSA-2023:6748","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46848","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245919","name":"RHBZ#2245919","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-2g3c-pg7q-g59w"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-681","description":"Incorrect Conversion between Numeric Types","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-02-25T18:19:24.166Z"},"datePublic":"2023-10-19T00:00:00.000Z","x_redhatCweChain":"CWE-681: Incorrect Conversion between Numeric Types","timeline":[{"lang":"en","time":"2023-10-24T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-10-19T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6266","name":"RHSA-2023:6266","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6268","name":"RHSA-2023:6268","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6748","name":"RHSA-2023:6748","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46848","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245919","name":"RHBZ#2245919","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-2g3c-pg7q-g59w","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0005/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T20:53:21.945Z"}}]}}}