{"id":"CVE-2023-5824","state":"PUBLISHED","title":"Squid: dos against http and https","description":"A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service.","publishedAt":"2023-11-03T07:56:36.369Z","updatedAt":"2025-11-06T20:51:27.614Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support","Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support","Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support","Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8090020231130092412.a75119d5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Advanced Update Support","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8020020240122164331.4cda2c84","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.2::appstream","cpe:/a:redhat:rhel_e4s:8.2::appstream","cpe:/a:redhat:rhel_aus:8.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Telecommunications Update Service","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8020020240122164331.4cda2c84","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.2::appstream","cpe:/a:redhat:rhel_e4s:8.2::appstream","cpe:/a:redhat:rhel_aus:8.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8020020240122164331.4cda2c84","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.2::appstream","cpe:/a:redhat:rhel_e4s:8.2::appstream","cpe:/a:redhat:rhel_aus:8.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8040020240122165847.522a0ee4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Telecommunications Update Service","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8040020240122165847.522a0ee4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8040020240122165847.522a0ee4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Extended Update Support","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8060020231222131040.ad008a3a","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8080020231222130009.63b34585","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.5-6.el9_3.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.2-1.el9_0.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.5-5.el9_2.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"squid","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"squid","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":["https://access.redhat.com/errata/RHSA-2023:7465","https://access.redhat.com/errata/RHSA-2023:7668","https://access.redhat.com/errata/RHSA-2024:0072","https://access.redhat.com/errata/RHSA-2024:0397","https://access.redhat.com/errata/RHSA-2024:0771","https://access.redhat.com/errata/RHSA-2024:0772","https://access.redhat.com/errata/RHSA-2024:0773","https://access.redhat.com/errata/RHSA-2024:1153","https://access.redhat.com/security/cve/CVE-2023-5824","https://bugzilla.redhat.com/show_bug.cgi?id=2245914","https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255","https://security.netapp.com/advisory/ntap-20231130-0003/","https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html"],"weaknesses":["CWE-755"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/5xxx/CVE-2023-5824.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-5824","state":"PUBLISHED","datePublished":"2023-11-03T07:56:36.369Z","dateUpdated":"2025-11-06T20:51:27.614Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-10-27T09:37:47.593Z"},"containers":{"cna":{"title":"Squid: dos against http and https","descriptions":[{"lang":"en","value":"A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8090020231130092412.a75119d5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Advanced Update Support","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8020020240122164331.4cda2c84","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.2::appstream","cpe:/a:redhat:rhel_e4s:8.2::appstream","cpe:/a:redhat:rhel_aus:8.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Telecommunications Update Service","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8020020240122164331.4cda2c84","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.2::appstream","cpe:/a:redhat:rhel_e4s:8.2::appstream","cpe:/a:redhat:rhel_aus:8.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8020020240122164331.4cda2c84","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.2::appstream","cpe:/a:redhat:rhel_e4s:8.2::appstream","cpe:/a:redhat:rhel_aus:8.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8040020240122165847.522a0ee4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Telecommunications Update Service","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8040020240122165847.522a0ee4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8040020240122165847.522a0ee4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Extended Update Support","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8060020231222131040.ad008a3a","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"squid:4","defaultStatus":"affected","versions":[{"version":"8080020231222130009.63b34585","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.5-6.el9_3.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Extended Update Support","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.2-1.el9_0.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"squid","defaultStatus":"affected","versions":[{"version":"7:5.5-5.el9_2.3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"squid","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"squid","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7465","name":"RHSA-2023:7465","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7668","name":"RHSA-2023:7668","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0072","name":"RHSA-2024:0072","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0397","name":"RHSA-2024:0397","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0771","name":"RHSA-2024:0771","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0772","name":"RHSA-2024:0772","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0773","name":"RHSA-2024:0773","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1153","name":"RHSA-2024:1153","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5824","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245914","name":"RHBZ#2245914","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-755","description":"Improper Handling of Exceptional Conditions","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2025-11-06T20:51:27.614Z"},"datePublic":"2023-10-19T00:00:00.000Z","x_redhatCweChain":"CWE-755: Improper Handling of Exceptional Conditions","workarounds":[{"lang":"en","value":"Disabling the disk caching mechanism will mitigate this vulnerability. To achieve this, remove all the 'cache_dir' directives from the Squid configuration, typically in the /etc/squid/squid.conf file."}],"timeline":[{"lang":"en","time":"2023-10-24T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-10-19T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7465","name":"RHSA-2023:7465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7668","name":"RHSA-2023:7668","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0072","name":"RHSA-2024:0072","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0397","name":"RHSA-2024:0397","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0771","name":"RHSA-2024:0771","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0772","name":"RHSA-2024:0772","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0773","name":"RHSA-2024:0773","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1153","name":"RHSA-2024:1153","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5824","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245914","name":"RHBZ#2245914","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20231130-0003/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T18:08:10.691Z"}}]}}}