DEBIAN-CVE-2025-54574

Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.

References

https://security-tracker.debian.org/tracker/CVE-2025-54574

Affected packages

Debian:12 / squid

Package

Name: squid
Purl: pkg:deb/debian/squid?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.7-2+deb12u3

Affected versions

5.*

5.7-2

5.7-2+deb12u1

5.7-2+deb12u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-54574.json"

Debian:13 / squid

Package

Name: squid
Purl: pkg:deb/debian/squid?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-54574.json"

Debian:14 / squid

Package

Name: squid
Purl: pkg:deb/debian/squid?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-54574.json"