CVE-2025-54574

Katalog CVE

CVSS 9.8 · Critical EPSS 23,7%

Kerentanan Heap-based Buffer Overflow pada squid-cache squid. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.

Rincian

Terbit di NVD

1 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

23,7% peluang dieksploitasi; lebih tinggi dari 97,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3 mitigasi · patch · advisory vendor
• https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988 patch
• https://github.com/squid-cache/squid/releases/tag/SQUID_6_4 release notes
• http://www.openwall.com/lists/oss-security/2025/11/05/5
• https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html