CVE-2023-46724

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125",
        "CWE-1285",
        "CWE-129",
        "CWE-786",
        "CWE-823"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46724.json"
}

References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type

GIT

Repo

https://github.com/squid-cache/squid

Events

Introduced

b6bc3157c337458cd6615fd2120fa5446f82d1c3

Fixed

1d8175b27fc1c347649d4f221ff2633e8d800429

Fixed

b70f864940225dfe69f9f653f948e787f99c3810

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.3.0.1"
                },
                {
                    "fixed":  "6.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "b70f864940225dfe69f9f653f948e787f99c3810"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46724.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "210215246844197458567831775363745291472",
            "length":  944
        },
        "id":  "CVE-2023-46724-2913b03e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810",
        "target":  {
            "file":  "src/anyp/Uri.cc",
            "function":  "matchDomainName"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "132297003046321410898293712443124375497",
                "141294028970175884415189950830511831259",
                "83365289692056968680299252530166654273",
                "263561776175962430572252611013012687107",
                "163679156619555015851941026236844524402",
                "182953648326232214989768464638856171680",
                "337849282034998695637314799915579350143"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2023-46724-6184ef0f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810",
        "target":  {
            "file":  "src/anyp/Uri.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5004815670061213126088965192724588639",
            "length":  1833
        },
        "id":  "CVE-2023-46724-c474f5d2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810",
        "target":  {
            "file":  "src/anyp/Uri.cc",
            "function":  "urlInitialize"
        }
    }
]

vanir_signatures_modified

"2026-10-28T10:39:05Z"