by Kastro
Paper/Archive/CVE-2025-54574

CVE-2025-54574

squid-cache squid — Squid's URN Handling can lead to Buffer Overflow

EPSS 24%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.8.978 × 2019.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.

Affected

ProductAffectedFixed inSource
squid< 6.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3refgithub.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988refgithub.com/squid-cache/squid/releases/tag/SQUID_6_4reflists.debian.org/debian-lts-announce/2025/09/msg00027.htmlrefopenwall.com/lists/oss-security/2025/11/05/5